← Back

CVE-2026-23866

nvd nist
Published: May 1, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: cve-assign@fb.com (Secondary)

Description

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Affected (2)

Products: Whatsapp: Whatsapp
Whatsapp
1 product
Whatsapp
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Whatsapp
Whatsapp
From 2.25.8.0 to 2.26.7.10
Whatsapp
From 2.25.8.0 to 2.26.15.72

Related CWEs

CWE-940
Improper Verification of Source of a Communication Channel
The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

References (2)

Source: cve-assign@fb.com
Third Party Advisory
Source: cve-assign@fb.com
Vendor Advisory

Timeline

No history available yet.