CVE-2023-38537

Summary

A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

Affected Software

VendorProductVersion RangeStatus
FacebookWhatsApp Desktop for Mac0 < 2.2338.12affected
FacebookWhatsApp Desktop for Windows0 < 2.2320.2affected
FacebookWhatsApp Business for iOS0 < 2.23.10.77affected
FacebookWhatsApp for iOS0 < 2.23.10.77affected
FacebookWhatsApp Business for Android0 < 2.23.10.77affected
FacebookWhatsApp for Android0 < 2.23.10.77affected

Weaknesses

  • CWE-416, CWE-366

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References