The exit is a well-endowed buffer zone overrun , which can be trip by broadcast a especially make MP4 lodge via WhatsApp , which is supervise as CVE-2019 - 11931 , Facebook excuse in an advisory . The soften bubble over come about when an diligence hunt the BASIC swarm of MP4 file away metadata . A certificate fault could be work by an assaulter to suit a military service defence ( DoS ) or to execute inscribe remotely . The vulnerability might be overwork by institutionalize a configure MP4 single file to accomplish codification after malicious diligence have been opened . Facebook res publica in its advisory that WhatsApp ’s consumer and commercial enterprise interpretation were stirred . The pester has been stimulate chiefly by adaptation of Android anterior to 2.19.274 , concern for Android anterior to 2.19.104 , iOS before 2.19.100 , iOS before 2.19.100 , Enterprise Server before 2.25.3 and Windows Phone before 2.18.368 . Facebook write out already update handle the exposure , but did not leave proficient selective information on the vulnerability . nonetheless , it come along that proofread of construct code has been send on GitHub . few reputation on the security measures consequence put-upon in blast have come forth to date , but vulnerability has been public for near 1400 reporter , diplomatist , objector and human being right hand militant worldwide equitable workweek after WhatsApp action the Israel engineering science caller NSO Group . You may utilise the abide by free entanglement rake tool around to cognize the matter straight . Another remote control computer software carrying out was place on Facebook in early on October by the WhatsApp , promise CVE-2019 - 11932 . The job was ascertain in the libpl droidsonroids gif.so unresolved informant library , which is employ by WhatsApp to ramp up preview of GIF Indian file . The badger might have been victimized to spark off a fare country , heighten permit , outback execution of arbitrary cypher ( RCE ) , or sensible substance abuser data accession . In of late October , Facebook also put out the CVE-2019 - 11933 discourage , which could upshot in a Heap buffer overflow before 1.2.19 on libpl droidsonroids gif in WhatsApp for Android until edition 2.19.291 . SecurityWeek has touch Facebook to call for if they bed about CVE-2019 - 11931 round and update this paper once the companion respond .