CVE-2025-30259

The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/
https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/

Configurations

No configuration.

History

No history.

Information

Published : 2025-03-20 00:15

Updated : 2026-06-17 09:08

NVD link : CVE-2025-30259

Mitre link : CVE-2025-30259

CVE.ORG link : CVE-2025-30259

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2025-30259", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30259", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-20T20:35:38.932684Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Meta", "product": "WhatsApp cloud service", "versions": [{"status": "affected", "version": "0", "lessThan": "late 2024", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-03-20T00:15:13.780", "references": [{"url": "https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/", "source": "cve@mitre.org"}, {"url": "https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL."}, {"lang": "es", "value": "Antes de finales de 2024, el servicio en la nube WhatsApp no bloqueaba determinados contenidos PDF manipulados que pueden vencer un mecanismo de protecci\u00f3n de la sandbox y, en consecuencia, permitir el acceso remoto a aplicaciones de mensajer\u00eda por parte de terceros, como se explot\u00f3 en 2024 para la instalaci\u00f3n de malware de Android asociado con BIGPRETZEL."}], "lastModified": "2026-06-17T09:08:24.910", "sourceIdentifier": "cve@mitre.org"}