CVE-2025-30401 json
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file…
published 2025-04-05 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-9915
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 21.0%
- EPSS 21.0% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
Patch / fix
- Facebook WhatsApp Desktop for Windows 2.2450.6
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
20.99% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L |
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L |
Affected products
- Facebook WhatsApp Desktop for Windows
References
-
facebook.com
/security/advisories/cve-2025-30401
third-party-advisory
- whatsapp.com /security/advisories/2025/
Sources
- CVE List CVE-2025-30401
- NVD CVE-2025-30401
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.