WhatsApp 0-Click Flaw Abused via Malicious DNG Image File

A newly discovered zero-click remote code execution vulnerability in WhatsApp is being demonstrated as affecting iOS, macOS and iPadOS devices, with researchers from DarkNavyOrg presenting a PoC exploit that requires no user interaction. The attack chain hinges on CVE-2025-55177, a logic error in WhatsApp’s message handling, followed by CVE-2025-43300 triggered by a crafted DNG image embedded in the message, while analysis of a Samsung-related CVE-2025-21043 is also mentioned.

According to DarkNavyOrg, WhatsApp fails to validate that an incoming message originates from a linked device, enabling a specially crafted DNG to cause a memory corruption error and deliver a remote payload, granting the attacker full control of the target device. The PoC automates logging into WhatsApp, generating the malformed DNG image, and sending it to the victim, with the attack executing silently and without any notification to the user.

The researchers warn the impact could enable interception of messages, theft of photos, call recording, and installation of additional malware across Apple devices, and both WhatsApp and Apple have been notified with updates and patches urged as soon as available.