New WhatsApp Flaws Could Affect Billions of Users After Meta Security Patch

WhatsApp users should update their apps after Meta patched two flaws that could make risky files and links harder to spot.

The vulnerabilities affected WhatsApp on iOS, Android, and Windows, including one issue tied to Instagram Reels previews and another involving spoofed filenames on Windows. Meta said there was no evidence that the flaws had been exploited in the wild, but the bugs matter because attackers often rely on trusted apps to make malicious content look routine.

“WhatsApp has fixed two security flaws that could be abused to interfere with how media and attachments are handled on your device,” Malwarebytes reported.

One flaw, tracked as CVE-2026-23866, affected Android and iOS devices. It stemmed from incomplete validation of AI-generated “rich response messages,” including previews tied to Instagram Reels. According to Cyber Press, a crafted message could trigger the app to process media from an attacker-controlled URL.

That behavior could also invoke operating system-level handlers, potentially opening apps or triggering unintended actions. While it does not directly compromise devices, it creates a pathway for phishing, tracking, or follow-on attacks.

Windows bug enabled spoofed files

The second flaw, CVE-2026-23863, affected WhatsApp for Windows versions before 2.3000.1032164386.258709. It involved improper handling of filenames containing embedded null bytes.

This allowed attackers to disguise executable files as harmless documents. In practice, a file could appear as a PDF or image in WhatsApp but run as a program when opened.

“In practice, a user might believe they are opening a safe file while unknowingly triggering a potentially dangerous executable,” The420.in highlighted.

The flaw reflects a common social engineering tactic in which attackers rely on user trust rather than technical exploits alone. For organizations, this raises the risk of malware delivery through routine communication tools.

Must-read security coverage

No exploitation seen, but patching remains critical

Meta said it has not observed any real-world exploitation of vulnerabilities. Both issues were disclosed through its bug bounty program and addressed by the company’s security team.

Even so, security experts warn that such flaws can be combined with other techniques. Messaging apps are increasingly part of the enterprise attack surface, especially as employees use them across devices.

Users can update WhatsApp through the Google Play Store, Apple App Store, or Microsoft Store. Organizations should confirm Windows systems are running updated versions and consider enabling automatic updates.

Beyond patching, IT teams should treat WhatsApp like any other workplace attack surface. Employees should be reminded that unexpected files, previews, and links can carry risk, even when they arrive through a trusted app or a familiar contact.

Stay ahead of WhatsApp’s September 8, 2026 Android cutoff by updating your device, backing up your chats, or switching to a supported phone before service ends.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts