CVE-2026-23866

4.3 Moyenne

Publiée le 01/05/2026 à 18:16 · Modifiée le 17/06/2026 à 12:22 · Analysée par le NVD · Source : cve-assign@fb.com

Description

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Traduire en français

Produits concernés

Facebook WhatsApp for Android
Facebook WhatsApp for iOS
Whatsapp whatsapp

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	cve-assign@fb.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-940

Références

https://www.facebook.com/security/advisories/cve-2026-23866 Third Party Advisory
https://www.whatsapp.com/security/advisories/2026 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories