CVE-2026-23863: Attachment Spoofing in WhatsApp Desktop

The primary impact of CVE-2026-23863 is the potential for tricking users into executing malicious code. An attacker could craft a document (e.g., a PDF or Word file) with a filename containing NUL bytes. When received via WhatsApp, the application might display the file with a harmless extension, like '.pdf'. However, when the user opens the file, the operating system might interpret it as an executable, leading to code execution. This could result in malware installation, data theft, or other malicious activities. The lack of authentication required for sending these malicious attachments increases the risk of widespread exploitation.

1. Veröffentlicht2026-05-01
2. EPSS aktualisiert2026-05-09

The primary mitigation for CVE-2026-23863 is to upgrade WhatsApp Desktop for Windows to version 2.3000.1032164386.258709 or later. Educate users about the risks of opening attachments from unknown or untrusted sources. Exercise caution when opening documents received via messaging applications. While no specific WAF or proxy rules are applicable, implementing general security awareness training can help users identify and avoid suspicious attachments. After upgrading, verify the fix by attempting to send a test document with a malicious filename and confirming that the application displays the correct file type and prevents execution.