CVE-2026-23863

Published: May 1, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: cve-assign@fb.com (Secondary)

Description

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.

Affected (1)

Products: Whatsapp: Whatsapp

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Whatsapp Whatsapp	Before 2.3000.1032164386.258709

Related CWEs

Improper Neutralization of Null Byte or NUL Character

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

References (2)

https://www.facebook.com/security/advisories/cve-2026-23863

Source: cve-assign@fb.com

Third Party Advisory

https://www.whatsapp.com/security/advisories/2026

Source: cve-assign@fb.com

Vendor Advisory

Timeline

No history available yet.