CVE-2026-23863
Analyzed Analyzed - Analysis Complete
WhatsApp for Windows Attachment Spoofing via NUL Byte Filename

Publication date: 2026-05-01

Last updated on: 2026-05-11

Assigner: Facebook, Inc.

Description
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-11
Generated
2026-06-16
AI Q&A
2026-05-01
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23863
EUVD
EUVD-2026-26665
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
whatsapp whatsapp to 2.3000.1032164386.258709 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-158 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, update WhatsApp for Windows to version 2.3000.1032164386.258709 or later, as the issue is fixed in these versions.

Executive Summary

This vulnerability is an attachment spoofing issue in WhatsApp for Windows versions prior to v2.3000.1032164386.258709. It involves maliciously formatted documents that contain embedded NUL bytes in their filenames. These files can appear as one type of file within the application but actually execute as a different type, specifically as an executable, when opened.

Impact Analysis

The impact of this vulnerability is that a user could be tricked into opening a file that looks harmless but actually runs executable code. This could lead to the execution of malicious software on the user's system, potentially compromising security, privacy, or system integrity.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart