CVE-2025-30259

LOW

WhatsApp PDF Content Sandbox Bypass

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2025-30259 has a selected CVSS score of 3.5 (low).

Description

The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 19, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 20, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

WhatsApp cloud service

Browse Meta / WhatsApp cloud service

Default status: unaffected

CVE ListBefore late 2024affected

WhatsApp Cloud Service

Browse WhatsApp / WhatsApp Cloud Service
VulnCheckVersion data not supplied

References

3