A Critical Zero-Click WhatsApp Flaw, CVE-2025-55177, Was Exploited in Zero-Day Attacks

WhatsApp and Apple were jointly highlighted in a report about a critical zero-click flaw, CVE-2025-55177, that was exploited in zero‑day attacks. Meta’s WhatsApp Security Team patched the issue affecting iOS, WhatsApp Business for iOS, and Mac, specifying vulnerable versions prior to v2.25.21.73, v2.25.21.78, and v2.25.21.78 respectively.

According to the advisory, incomplete authorisation of linked device synchronization messages could allow an unrelated user to trigger processing of content from an attacker-controlled URL on a victim’s device, with the risk amplified when paired with an OS-level vulnerability on Apple platforms (CVE-2025-43300). Apple subsequently released emergency updates for iOS, iPadOS and macOS to fix CVE-2025-43300, an out-of-bounds write in Image I/O, which can lead to crashes, data corruption or remote code execution.

Given the targeted nature of exploitation, the article notes that the risk to average users may be low, but remains critical for high-value targets such as journalists, diplomats and executives.