WhatsApp Points Emergency Replace for Zero-Click on Exploit Focusing on iOS and macOS Units

Aug 30, 2025Ravie LakshmananZero-Day / Vulnerability

WhatsApp has addressed a safety vulnerability in its messaging apps for Apple iOS and macOS that it mentioned might have been exploited within the wild along with a lately disclosed Apple flaw in focused zero-day assaults.

The vulnerability, CVE-2025-55177 (CVSS rating: 8.0), pertains to a case of inadequate authorization of linked system synchronization messages. Inner researchers on the WhatsApp Safety Staff have been credited with discovering and rerating the bug.

The Meta-owned firm mentioned the difficulty “might have allowed an unrelated consumer to set off processing of content material from an arbitrary URL on a goal’s system.”

The flaw impacts the next variations –

WhatsApp for iOS previous to model 2.25.21.73
WhatsApp Enterprise for iOS model 2.25.21.78, and
WhatsApp for Mac model 2.25.21.78

It additionally assessed that the shortcoming might have been chained with CVE-2025-43300, a vulnerability affecting iOS, iPadOS, and macOS, as a part of a classy assault towards particular focused customers.

CVE-2025-43300 was disclosed by Apple final week as having been weaponized in an “extraordinarily subtle assault towards particular focused people.”

The vulnerability in query is an out-of-bounds write vulnerability within the ImageIO framework that would lead to reminiscence corruption when processing a malicious picture.

Donncha Ó Cearbhaill, head of the Safety Lab at Amnesty Worldwide, mentioned WhatsApp has notified an unspecified variety of people that they imagine have been focused by a complicated spyware and adware marketing campaign previously 90 days utilizing CVE-2025-55177.

Within the alert despatched to the focused people, WhatsApp has additionally really useful performing a full system manufacturing unit reset and holding their working system and the WhatsApp app up-to-date for optimum safety. It is presently not identified who, or which spyware and adware vendor, is behind the assaults.

Ó Cearbhaill described the pair of vulnerabilities as a “zero-click” assault, which means it doesn’t require any consumer interplay, corresponding to clicking a hyperlink, to compromise their system.

“Early indications are that the WhatsApp assault is impacting each iPhone and Android customers, civil society people amongst them,” Ó Cearbhaill mentioned. “Authorities spyware and adware continues to pose a risk to journalists and human rights defenders.”