CVE-2026-23866

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.facebook.com/security/advisories/cve-2026-23866	Third Party Advisory
https://www.whatsapp.com/security/advisories/2026	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:whatsapp:whatsapp::::::android::*
	cpe:2.3:a:whatsapp:whatsapp::::::iphone_os::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Validación incompleta de mensajes de respuesta enriquecidos de IA para Instagram Reels en WhatsApp para iOS v2.25.8.0 a v2.26.15.72 y WhatsApp para Android v2.25.8.0 a v2.26.7.10 podría haber permitido a un usuario activar el procesamiento de contenido multimedia desde una URL arbitraria en el dispositivo de otro usuario, incluyendo la activación de manejadores de esquemas de URL personalizados controlados por el SO. No hemos visto evidencia de explotación en la naturaleza.

Information

Published : 2026-05-01 16:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-23866

Mitre link : CVE-2026-23866

CVE.ORG link : CVE-2026-23866

JSON object : View

Products Affected

whatsapp

whatsapp

CWE

CWE-940

Improper Verification of Source of a Communication Channel

{"id": "CVE-2026-23866", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23866", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T17:41:43.060585Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve-assign@fb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve-assign@fb.com", "affectedData": [{"vendor": "Facebook", "product": "WhatsApp for Android", "versions": [{"status": "affected", "version": "2.25.8.0", "lessThan": "2.26.7.10", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Facebook", "product": "WhatsApp for iOS", "versions": [{"status": "affected", "version": "2.25.8.0", "lessThan": "2.26.15.72", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-01T16:16:29.980", "references": [{"url": "https://www.facebook.com/security/advisories/cve-2026-23866", "tags": ["Third Party Advisory"], "source": "cve-assign@fb.com"}, {"url": "https://www.whatsapp.com/security/advisories/2026", "tags": ["Vendor Advisory"], "source": "cve-assign@fb.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-940"}]}], "descriptions": [{"lang": "en", "value": "Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user\u2019s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild."}, {"lang": "es", "value": "Validaci\u00f3n incompleta de mensajes de respuesta enriquecidos de IA para Instagram Reels en WhatsApp para iOS v2.25.8.0 a v2.26.15.72 y WhatsApp para Android v2.25.8.0 a v2.26.7.10 podr\u00eda haber permitido a un usuario activar el procesamiento de contenido multimedia desde una URL arbitraria en el dispositivo de otro usuario, incluyendo la activaci\u00f3n de manejadores de esquemas de URL personalizados controlados por el SO. No hemos visto evidencia de explotaci\u00f3n en la naturaleza."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "A9F5775D-2CBD-427C-94CD-D01C11559B06", "versionEndIncluding": "2.26.7.10", "versionStartIncluding": "2.25.8.0"}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "9C83C05F-A88D-48B7-8DE8-5B8CBD9FC6B9", "versionEndIncluding": "2.26.15.72", "versionStartIncluding": "2.25.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve-assign@fb.com"}