CVE-2025-55177 affects WhatsApp client applications on iOS and macOS, allowing unauthorized processing of content from arbitrary URLs through crafted synchronization messages. While it has network attack vector and active exploitation evidence, it targets client applications rather than internet-facing servers.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: OTHER
CVE Published: 2025-08-29
Added to CISA KEV: 2025-09-02 4 DAYS BETWEEN CVE AND KEV
Explore details for CVE-2025-55177, a zero-day vulnerability in WhatsApp iOS and macOS messaging clients, with insights on the SOC Prime ...
CVE-2025-55177 allows unauthorized processing of remote content on a victim's device via crafted synchronization messages . It impacts WhatsApp for iOS prior to version 2.25. 21.73, WhatsApp Business for iOS, and WhatsApp for Mac prior to version 2.25. 21.78.
These were added due to evidence of active exploitation and are frequent attack vectors for malicious actors. CISA believes these flaws present ...
... vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.
The vulnerability, CVE-2025-55177 (CVSS score: 8.0), relates to a case of insufficient authorization of linked device synchronization messages.