Vulnerability Description
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| >= 2.25.8.0, <= 2.26.7.10 |
Related Weaknesses (CWE)
References
- https://www.facebook.com/security/advisories/cve-2026-23866Third Party Advisory
- https://www.whatsapp.com/security/advisories/2026Vendor Advisory
FAQ
What is CVE-2026-23866?
CVE-2026-23866 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigge...
How severe is CVE-2026-23866?
CVE-2026-23866 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-23866?
Check the references section above for vendor advisories and patch information. Affected products include: Whatsapp Whatsapp.