CVE-2025-30401
First published: Sat Apr 05 2025(Updated: )
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
Credit: cve-assign@fb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <2.2450.6 | ||
| <2.2450.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-30401?
The severity of CVE-2025-30401 is high due to the potential for executing arbitrary code through spoofed file attachments.
How do I fix CVE-2025-30401?
To fix CVE-2025-30401, update WhatsApp for Windows to version 2.2450.6 or later.
What is the impact of CVE-2025-30401 on user security?
CVE-2025-30401 can lead to security risks where users might inadvertently execute malicious files.
Which versions of WhatsApp for Windows are affected by CVE-2025-30401?
WhatsApp for Windows versions prior to 2.2450.6 are affected by CVE-2025-30401.
Can CVE-2025-30401 be exploited remotely?
Yes, CVE-2025-30401 can be exploited remotely by sending malicious file attachments to users.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2025-30401
- collector/the-register
- source/The Register
- agent/news-ai
- agent/severity
- agent/source
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- collector/nvd-api
- source/NVD
- agent/event
- vendor/whatsapp
- canonical/whatsapp