CVE-2025-55177

VendorwhatsappProductwhatsapp, whatsapp businessDiscoveredAug 29, 2025UpdatedOct 7, 2026

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

View graph Watch Export

CVSS v3.1

5.4 MEDIUM

EPSS

13.5%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Oct 30, 2026

▲ 9.31pp

4.21% → 13.5% over 5 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

ScopeUNCHANGED

ConfidentialityLOW

IntegrityLOW

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Connections

8 relationships

CWE-863

source

Timeline

disclosure → media coverage

Aug 29, 2025

Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026

Sep 2, 2025

securityweek.com reports: WhatsApp Zero-Day Exploited in Attacks Targeting Apple Users

Aug 27, 2026

redhotcyber.com reports: WhatsApp sotto attacco su iPhone: la nuova ondata zero-click in Italia e la ricostruzione internazionale della minaccia

Aug 28, 2026

incibe.es reports: Ataques sin interacción contra cuentas de WhatsApp en iPhone con iOS 16

Sep 29, 2026

securityweek.com reports: Apple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’

Public PoC (1)

github.com/danielw98/zero-click-exploit-analysis

Unverified third-party code — review before executing.