Meta Addresses Two Medium Severity Vulnerabilities in WhatsApp

Meta has disclosed two vulnerabilities in WhatsApp, CVE-2026-23863 and CVE-2026-23866, in a security advisory published on May 1, 2026. Both vulnerabilities were discovered through Meta's bug bounty program and are rated as medium severity. CVE-2026-23863 affects WhatsApp for Windows and involves an attachment spoofing issue that could allow malicious files to masquerade as safe documents. CVE-2026-23866 impacts WhatsApp for iOS and Android, allowing unauthorized processing of media content via AI-rich responses for Instagram Reels. Fortunately, there is no evidence that these vulnerabilities were exploited in the wild, and both have been patched. Users are advised to update their apps to ensure protection against these threats. Meta has emphasized the importance of the security research community in identifying these issues before they could be exploited. The vulnerabilities were fixed in April and earlier this year, respectively.

Key Points: • Two medium severity vulnerabilities in WhatsApp have been disclosed and patched. • CVE-2026-23863 involves attachment spoofing on Windows, while CVE-2026-23866 affects mobile apps. • No evidence of exploitation has been found, and users are urged to update their apps.