Vulnerability record · CVE-2021-24042 · published 4 January 2022

CVE-2021-24042: Whatsapp heap-based buffer overflow vulnerability

Whatsapp · Whatsapp

The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.

9.8 CVSS 3.1 Critical EPSS 1.2% · top 32.0% CWE-122 · Heap-based buffer overflowCWE-787 · Out-of-bounds write

9.8CVSS 3.1 base score, v2 7.5

1.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Whatsapp Whatsapp

References

Link	Tags
https://www.whatsapp.com/security/advisories/2021/	Not ApplicableVendor Advisory
https://www.whatsapp.com/security/advisories/2021/	Not ApplicableVendor Advisory

Track CVE-2021-24042 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-3568WhatsApp VOIP stack heap buffer overflow allows remote code executionA heap-based buffer overflow in the WhatsApp VOIP stack can be triggered by a specially crafted series of RTCP packets sent to a target phone number,…KEVEPSS 30%analysed14 May 2019 8.2CVE-2019-18426WhatsApp Desktop link preview XSS and local file readWhatsApp Desktop before 0.3.9309, when paired with WhatsApp for iPhone before 2.20.10, is vulnerable to cross-site scripting and local file reading. …KEVEPSS 68%analysed21 Jan 2020 5.4CVE-2025-55177WhatsApp iOS and Mac linked-device sync authorization flawWhatsApp for iOS, WhatsApp Business for iOS and WhatsApp for Mac fail to fully authorize linked-device synchronization messages, letting an unrelated…KEVEPSS 4.3%analysed29 Aug 2025 9.8CVE-2022-36934Whatsapp heap-based buffer overflow vulnerabilityAn integer overflow in WhatsApp could result in remote code execution in an established video call.EPSS 2.4%22 Sep 2022 9.8CVE-2021-24041Whatsapp heap-based buffer overflow vulnerabilityA missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowe…EPSS 1.4%7 Dec 2021 9.8CVE-2021-24026Whatsapp out-of-bounds write vulnerabilityA missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android …EPSS 1.4%6 Apr 2021 9.8CVE-2020-1909Whatsapp use after free vulnerabilityA use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in …EPSS 2.3%3 Nov 2020 9.8CVE-2020-1907Whatsapp out-of-bounds write vulnerabilityA stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.…EPSS 1.9%6 Oct 2020

Source: NIST National Vulnerability Database (record CVE-2021-24042), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.