WhatsApp has shared details on a zero-day vulnerability that was exploited in highly targeted attacks against Apple users.
Tracked as CVE-2025-55177 (CVSS score of 5.4), the bug is described as an “incomplete authorization of linked device synchronization messages”.
An attacker could have exploited the issue to trigger the processing of content from arbitrary URLs, on the victims’ devices, WhatsApp’s advisory reads.
“We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users,” the Meta-owned communication platform says.
Patched on August 20, CVE-2025-43300 is an out-of-bounds write issue that impacts the ImageIO framework component of Apple’s iOS, iPadOS, and macOS products.
The Cupertino-based tech giant resolved the flaw in iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10, macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8, without sharing technical information on it, but warning of its active exploitation.
“Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals,” Apple said.
WhatsApp, which patched CVE-2025-55177 in July and August in WhatsApp for iOS version 2.25.21.73, WhatsApp Business for iOS version 2.25.21.78, and WhatsApp for Mac version 2.25.21.78, did not share details on the observed attacks either.
According to Amnesty International’s Donncha Ó Cearbhaill, however, the security defects were chained in zero-click attacks, part of a suspected spyware campaign.
“Early indications are that the WhatsApp attack is impacting both iPhone and Android users, civil society individuals among them. Government spyware continues to pose a threat to journalists and human rights defenders,” Ó Cearbhaill said on X.
Given that the Apple flaw impacts a core image library, the attackers might have exploited it using other applications as well, Ó Cearbhaill says.
In addition to rolling out patches for the zero-day, WhatsApp sent notifications to the potentially targeted individuals. Less than 200 people were notified, Meta told SecurityWeek.
“WhatsApp and Apple devices are some of the most widely used technologies on the planet, especially among senior executives. That popularity makes them prime targets. Attackers know that if they can find a way in, the payoff is huge. It is why we see significant investment from adversaries in uncovering zero-click vulnerabilities like this one,” Jamf senior security strategy manager Adam Boynton said.
On September 2, the US cybersecurity agency CISA added CVE-2025-55177 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by September 23.
*Updated to mention the bug’s addition to CISA KEV.
Related: Paragon Spyware Attacks Exploited WhatsApp Zero-Day
Related: Spyware Maker NSO Ordered to Pay $167 Million Over WhatsApp Hack
Related: $1 Million Offered for WhatsApp Exploit at Pwn2Own Ireland 2025
