Back
CVE-2018-6339
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An…
Critical9.8EPSS 1.5%
- Published
- Updated
- Reserved
- Assigned by
Description
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 25% of all CVEs (5 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
Affected products
Facebook · WhatsApp for Android
- affected 2.18.295
- affected 2.18.180 – < unspecified
- unaffected unspecified – < 2.18.180
Facebook · WhatsApp Business for Android
- affected 2.18.150
- affected 2.18.103 – < unspecified
- unaffected unspecified – < 2.18.103
References (1)
- https://www.facebook.com/security/advisories/cve-2018-6339/ (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-6339)Record last updated .