PT-2026-36500 · Meta · Whatsapp

Published 2026-05-01 · Updated 2026-05-05 · CVE-2026-23866

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WhatsApp for iOS versions 2.25.8.0 through 2.26.15.72 WhatsApp for Android versions 2.25.8.0 through 2.26.7.10

Description Incomplete validation of AI rich response messages for Instagram Reels allows a user to trigger the processing of media content from an arbitrary URL on another user's device. This can include triggering OS-controlled custom URL scheme handlers, which are specific protocols used by the operating system to open corresponding applications.

Recommendations Update WhatsApp for iOS to a version later than 2.26.15.72. Update WhatsApp for Android to a version later than 2.26.7.10.

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-23866

Affected Products

Whatsapp

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-23866 · Security Note
• https://reddit.com/r/pwnhub/comments/1t4ekv5/whatsapp_reveals_mediumimpact_vulnerabilities_in · Reddit Post
• https://facebook.com/security/advisories/cve-2026-23866 · Note
• https://twitter.com/arnaudmercier/status/2050660323565121874 · Twitter Post
• https://twitter.com/CVEnew/status/2050254022263591349 · Twitter Post
• https://twitter.com/grok/status/2051813480953503940 · Twitter Post
• https://twitter.com/securestep9/status/2051628993460277686 · Twitter Post
• https://whatsapp.com/security/advisories/2026 · Note