CVE-2019-3568

What Is WhatsApp?

WhatsApp is one of the most widely used messaging platforms in the world, providing end-to-end encrypted messaging and voice/video calling to over a billion users. Its voice-calling feature relies on the VOIP (RTP/RTCP) protocol stack built into the client, which — like any code parsing untrusted network data — is a potential target for memory-corruption vulnerabilities reachable simply by placing a call, without any action from the victim.

Overview

CVE-2019-3568 is a critical stack-based buffer overflow (CWE-121/122 family, classified here as CWE-122 Heap-Based Buffer Overflow) in WhatsApp's VOIP stack. A specially crafted series of RTCP packets sent as part of a WhatsApp voice call could trigger the overflow and achieve remote code execution on the target device — critically, the victim did not need to answer the call, and in some cases the malicious call would be silently removed from the call log, leaving no visible trace. CVSS score: 9.8.

Technical Details

The vulnerability lies in how WhatsApp's VOIP implementation parses incoming RTCP (RTP Control Protocol) packets during call setup and signaling. By crafting malformed RTCP packet contents and sending them via a WhatsApp voice call to the target's phone number, an attacker could overflow a fixed-size buffer, corrupting adjacent memory in a way that allowed control of program execution. Because the exploit was delivered over the call signaling path, no user interaction (answering the call) was required for successful exploitation, and the malicious call could be configured to disappear from the recipient's call history — making the compromise essentially invisible to the victim.

Discovery

WhatsApp's security team identified in-the-wild exploitation in May 2019 and moved quickly to patch affected client versions across Android, iOS, Windows Phone, Tizen, and other platforms. Subsequent investigation and litigation established that the exploit had been developed and operated by NSO Group, the Israeli spyware vendor, as a delivery mechanism for its Pegasus surveillance platform.

Exploitation Context

This vulnerability is one of the most notable mobile zero-days ever disclosed: it was used to target roughly 1,400 WhatsApp users, including human rights defenders, journalists, and a UK-based lawyer representing victims of alleged NSO Group surveillance abuses, according to WhatsApp's own investigation and subsequent legal filings. WhatsApp (via parent company Meta) sued NSO Group in US federal court in October 2019 specifically over this vulnerability's exploitation, in a case that has had significant legal and policy implications for the commercial spyware industry, including a 2024 court ruling on NSO Group's liability. It remains a textbook example of a "zero-click" mobile exploit used for targeted surveillance rather than broad criminal exploitation.

Remediation

1. Update WhatsApp to the patched version for your platform (released May 13–14, 2019, and all subsequent versions) — do not run outdated WhatsApp clients.
2. Enable automatic app updates on mobile devices to ensure rapid patching of future messaging app vulnerabilities.
3. Apply mobile OS security updates promptly, since many zero-click exploit chains combine an app-level bug like this with OS-level sandbox escapes.
4. High-risk individuals (journalists, activists, government officials, executives) should consider additional protections such as Apple's Lockdown Mode or equivalent hardened configurations, given this vulnerability's documented use in targeted surveillance.
5. Review device behavior for signs of compromise (unusual battery drain, unexpected data usage, unfamiliar call log entries) if there is reason to believe a device may have been targeted during the active exploitation window.