PT-2026-36499 · Meta · Whatsapp For Windows

Published 2026-05-01 · Updated 2026-06-01 · CVE-2026-23863

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WhatsApp for Windows versions prior to 2.3000.1032164386.258709

Description An attachment spoofing issue exists due to improper handling of hidden control characters, specifically embedded NUL bytes, in filenames. This allows maliciously formatted documents to be displayed as one file type within the application but execute as an executable file when opened. The issue stems from a failure to properly sanitize or validate the true file extension when displaying attachments.

Recommendations Update to version 2.3000.1032164386.258709 or later.

Fix

RCE

Weakness Enumeration

CWE-158

Related Identifiers

CVE-2026-23863

Affected Products

Whatsapp For Windows

References · 13

• https://whatsapp.com/security/advisories/2026 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23863 · Security Note
• https://twitter.com/lyrie_ai/status/2061236546943021473 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1t4ekv5/whatsapp_reveals_mediumimpact_vulnerabilities_in · Reddit Post
• https://twitter.com/arnaudmercier/status/2050660323565121874 · Twitter Post
• https://twitter.com/NoctisIntel/status/2052066694282334501 · Twitter Post
• https://twitter.com/CVEnew/status/2050254023412846829 · Twitter Post
• https://facebook.com/security/advisories/cve-2026-23863 · Note
• https://t.me/cveNotify/163088 · Telegram Post
• https://twitter.com/lyrie_ai/status/2061236543897923863 · Twitter Post
• https://twitter.com/lyrie_ai/status/2061236545680560227 · Twitter Post
• https://twitter.com/lyrie_ai/status/2061236544896164146 · Twitter Post
• https://twitter.com/lyrie_ai/status/2061236546703876430 · Twitter Post