WhatsApp has announced a critical security vulnerability, designated CVE-2025-55177, which has been exploited in sophisticated zero-click attacks targeting users of its messaging platform on Apple devices. The company confirmed that the flaw was found in its applications for iOS and Mac, specifically in versions prior to 2.25.21.73 and 2.25.21.78, respectively. 'We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users,' WhatsApp stated in its security advisory on August 29, 2025. This combination of vulnerabilities has raised significant concerns about the potential compromise of sensitive user data, including messages and personal information.
The vulnerability was identified as stemming from an 'incomplete authorization of linked device synchronization messages' in WhatsApp, which allowed unauthorized users to trigger the processing of content from arbitrary URLs on a target's device without user interaction. This zero-click capability is particularly alarming, as it enables attackers to infiltrate devices silently. The additional exploitation of CVE-2025-43300, an out-of-bounds write vulnerability in Apple's ImageIO framework, has amplified the threat. Apple had previously patched this OS-level vulnerability, indicating that it had been exploited in 'extremely sophisticated attacks against specific targeted individuals.'
Security experts have underscored the complexity of these attacks, with Donncha Ó Cearbhaill, head of the Security Lab at Amnesty International, noting that WhatsApp has warned certain users about being targeted in an advanced spyware campaign over the past 90 days. The attacks exemplify a sophisticated use of vulnerabilities that could potentially affect a large number of users.
In response to these threats, WhatsApp has released patches and urged users to update to the latest versions of its applications. The company has emphasized the importance of these updates to mitigate risks associated with the identified vulnerabilities. The cybersecurity community is closely monitoring the situation, with experts analyzing the implications of these exploits and the ongoing threats posed to users. 'We've made changes to prevent this specific attack from occurring through WhatsApp. However, your device's operating system could remain compromised by other vulnerabilities,' WhatsApp noted.
Going forward, users are advised to ensure their applications are updated to the most recent versions to protect against these vulnerabilities. The security community continues to investigate the full extent of the exploits and their impact on user security, with detailed guidance expected as more information becomes available.
