WhatsApp fixes vulnerability used in zero-click attacks

WhatsApp says it has issued an update to patch a vulnerability that has been used in conjunction with an Apple vulnerability to target specific users and compromise their devices. Reportedly, attackers used this exploit against dozens of WhatsApp users, and WhatsApp has notified those affected. Our investigation includes the two CVEs involved: CVE-2025-43300 in the Apple Image I/O framework for iOS and macOS, and CVE-2025-55177 relating to WhatsApp on iOS and certain WhatsApp versions.

According to Amnesty International Security Lab, the vulnerability was part of a zero-click attack affecting both iPhone and Android users, with the most severe risk described as applying to Apple devices. The guidance for affected users includes performing a full factory reset, keeping devices updated to the latest OS version, and ensuring WhatsApp is up to date.