Redazione RHC : 30 August 2025 10:56
A security flaw in WhatsApp’s messaging apps for Apple iOS and macOS has been patched, the company reported, after likely being widely exploited alongside a recently discovered Apple vulnerability in targeted zero-day attacks.
A case of insufficient authorization for syncing messages between connected devices is behind the vulnerability, identified as CVE-2025-55177, with a CVSS score of 8.0, which has been exploited by surveillance software (spyware). The discovery and subsequent reassessment of the bug are attributed to researchers on WhatsApp’s security team.
Donncha Ó Cearbhaill, head of Amnesty International’s Security Lab, said WhatsApp has alerted an unknown number of individuals it believes were targeted by an advanced spyware campaign over the past 90 days that used the exploit code CVE-2025-55177.
A message sent to potential targets advised them, as a security measure, to completely reset their device to its original settings and to ensure they always have their operating system and WhatsApp app up to date for optimal protection. The identity of the perpetrator, or the company producing the spyware used, remains unknown for now. Unknown.
The flaw affects WhatsApp for iOS versions prior to version 2.25.21.73, WhatsApp Business for iOS version 2.25.21.78, and WhatsApp for Mac version 2.25.21.78. The vulnerability in question is an out-of-bounds write vulnerability in the ImageIO framework that could cause memory corruption when processing a malicious image.
Last week, it was disclosed that CVE-2025-43300 bug being used as a tool in a fierce cyber offensive aimed at targeting individual targets with extremely sophisticated techniques. The Meta-owned company stated that the issue “could have allowed an unrelated user to trigger the processing of content from an arbitrary URL on a target’s device.”
It was also assessed that the flaw may have been linked to the CVE-2025-43300 vulnerability, which affects iOS, iPadOS, and macOS, as part of a sophisticated attack against specific users.
Redazione