WhatsApp Reveals Critical Vulnerabilities in Older App Versions That Let Attacker Exploit Phones via Video Call

WhatsApp, Meta's instant messaging and calling service, has published details of a 'critical' vulnerability that has been patched in a newer version of the app but might still affect older installed versions that have not been updated.

The details regarding the vulnerability were revealed in a September update of WhatsApp's page on security advisories affecting the app and came to light on September 23.

WhatsApp, in the update, shared a detailed issue related to vulnerability CVE-2022-36934, according to which "an integer overflow in WhatsApp for Android prior to v2.22.16.12, Business for Android prior to v2.22.16.12, iOS prior to v2.22.16.12, Business for iOS prior to v2.22.16.12 could result in remote code execution in an established video call."

According to the details, the bug would let an attacker exploit integer overflow, after which they can get access to execute their own code on a victim's smartphone through a specially crafted video call.

This vulnerability has been given a severity score of 9.8 out of 10 on the CVE scale.

In the same security advisory update, WhatsApp also explained another vulnerability, CVE-2022-27492. According to the social media company, "an integer underflow in WhatsApp for Android prior to v2.22.16.2, WhatsApp for iOS v2.22.15.9 could have caused remote code execution when receiving a crafted video file."

This said, the bug would let attackers execute the code on the victim's smartphone using a malicious video file. The vulnerability was scored 7.8 out of 10.

In an India-related development for the social media platform, the head of WhatsApp's India payment business, Manesh Mahatme, has quit after more than a year with the Meta Platforms-owned company to join Amazon India, a source told Reuters on Thursday.

Mahatme's exit comes at a critical time for WhatsApp, which is seeking to ramp up its payments service in a highly competitive market and lock horns with more established players such as Alphabet's Google Pay, Ant Group-backed Paytm and Walmart's PhonePe.

During his stint at WhatsApp Pay, the company won regulatory approval to more than double its payments offering to 100 million users in India, its biggest market with more than half a billion users overall.