WhatsApp Bug Anchors Targeted Zero-Click iPhone Attacks

Attackers are exploiting a WhatsApp security vulnerability affecting iOS in a sophisticated zero-click attack aimed at targeted Apple users, with the campaign also leveraging a previously discovered and patched iOS flaw, CVE-2025-43300. The new bug, CVE-2025-55177 (CVSS 5.4), affects WhatsApp on iOS and could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device, according to an advisory posted by the Computer Infrastructure and Security Agency (CISA).

The incidents have affected around 200 people so far, and the US government has urged users across its federal workforce to update their devices immediately. WhatsApp’s advisory describes the issue as an incomplete authorisation of linked device synchronization messages, and the company has updated its app to fix the flaw, advising users to install the latest version.

The previously disclosed Apple flaw is an out-of-bounds write issue used in August zero-day attacks and was patched on 20 August; Apple’s advisory notes that memory corruption may result from processing a malicious image file, with updates improving bounds checking in the latest OS versions. Public figures, journalists and activists may be particularly targeted, and Amnesty International notes that Android users could also be affected.