CVE-2025-55177: WhatsApp Zero-Click Flaw Used in Targeted Campaigns

CVE-2025-55177: WhatsApp Zero-Click Vulnerability Exploited in Targeted Campaigns

Summary

In August 2025, a critical zero-click vulnerability in WhatsApp (CVE-2025-55177) was exploited in highly targeted zero-day attacks against fewer than 200 high-value individuals worldwide. This flaw, affecting WhatsApp iOS and macOS clients, was chained with Apple’s CVE-2025-43300 (Out-of-Bounds Write in iOS, iPadOS, and macOS) to enable full device compromise.

The WhatsApp vulnerability stemmed from incomplete authorization handling of linked device synchronization messages, allowing attackers to force victim devices to process malicious content. Meta Platforms and Apple confirmed active exploitation of both flaws. Users are strongly urged to update WhatsApp and their devices immediately.

Vulnerability Details

• CVE-2025-55177 (WhatsApp Incorrect Authorization Vulnerability)

  • Affected Products: WhatsApp for iOS (prior to v2.25.21.73), WhatsApp Business for iOS (v2.25.21.78), WhatsApp for Mac (v2.25.21.78).

  • CWE ID: CWE-863 (Incorrect Authorization).

  • Exploitation: Allowed attackers to load and process arbitrary URLs on victim devices without user interaction.

• CVE-2025-43300 (Apple Out-of-Bounds Write Vulnerability)

  • Affected Products: macOS (before Sequoia 15.6.1, Sonoma 14.7.8, Ventura 13.7.8), iOS/iPadOS (before 18.6.2 and 17.7.10).

  • CWE ID: CWE-787 (Out-of-Bounds Write).

  • Exploitation: Used in tandem with CVE-2025-55177 to escalate privileges and execute arbitrary code at the OS level.

The chained exploitation technique highlights the increasing sophistication of multi-stage attack chains aimed at surveillance and espionage targeting influential individuals.

Recommendations

• Update Immediately: Install the latest versions of WhatsApp and Apple operating systems.

• Full Device Reset if Notified: Users receiving WhatsApp’s in-app threat notifications should perform a factory reset to ensure complete removal of malicious traces.

• Enable Auto-Updates: Turn on automatic updates for apps and operating systems to ensure timely patching.

• Practice Safe Browsing: Avoid clicking unexpected or suspicious links, even if they appear to be from trusted contacts.

• Strengthen Vulnerability Management: Regularly assess, patch, and track software versions to minimize risks from zero-day exploits.

MITRE ATT&CK TTPs

• Execution: T1203 (Exploitation for Client Execution), T1204 (User Execution), T1204.001 (Malicious Link)

• Resource Development: T1588 (Obtain Capabilities), T1588.006 (Vulnerabilities)

• General Tactics: TA0042 (Resource Development), TA0002 (Execution)

References

• WhatsApp Security Advisories 2025

• SOCRadar – CVE-2025-55177 Exploit Analysis

• Hive Pro – CVE-2025-43300 Advisory

• Apple Security Updates

Patch Links

• Download Latest WhatsApp

• Apple iOS/macOS Patches