Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp
Summary: Project Zero's Natalie Silvanovich fuzzed WhatsApp's video calling, which uses PJSIP rather than WebRTC, by hooking the memcpy that copies packets just before encryption and redirecting it to a custom fuzzing library loaded via dlopen. The setup produced a crash in roughly fifteen minutes and yielded one heap corruption issue, CVE-2018-6344, which has since been fixed; after that, fuzzing produced no further crashes with security impact.
What's compelling: One heap corruption bug in a calling stack used by a messaging app with billions of users is enough to matter, and the researcher notes that after CVE-2018-6344 was fixed, further fuzzing found nothing of security impact - meaning the next flaw in this code path may not surface through the same method.
Read the original at Google Project Zero ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026