CVE-2019-3568 is a VOIP stack buffer overflow vulnerability in Meta Platforms WhatsApp. CISA added it to the Known Exploited Vulnerabilities catalogue on 19 April 2022, which means attackers have used it in real attacks. A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
What Makes This Vulnerability Dangerous
A buffer overflow in a voice-over-IP stack is dangerous because it can let an attacker overwrite memory in a component that processes remote network traffic. In this case, the exploit path matters because the target can be reached through specially crafted RTCP packets, so the weakness sits in the media handling path rather than in a user-facing feature.
That kind of flaw is especially serious in messaging and calling software because the affected code often handles untrusted input before the user can meaningfully intervene. Once memory corruption is triggered, the outcome can move beyond a crash into arbitrary code execution, which turns a single malformed call-related exchange into a potential device compromise.
How Organisations Check Exposure
Exposure review starts with knowing where the product is installed and whether it is reachable from the internet or exposed to external callers. Teams should confirm device inventories, mobile fleet coverage, and any vendor-managed update path, then compare those assets against the vendor advisory and the CVE Program record to establish whether the identifier matches the exact issue under review.
For urgent exploitation tracking, the most useful external reference is the NIST National Vulnerability Database, because it centralises the canonical record, vulnerability description, and reference links that help security teams verify what they are dealing with. In parallel, vulnerability management should treat the issue as a KEV-prioritised exposure and not as a routine backlog item.
Remediation and Compensating Controls
The primary remediation is to apply the vendor fix for the exact affected build as soon as it is available. Where patching must be delayed, reduce exposure by restricting unnecessary inbound reachability, limiting VoIP-related traffic paths, and tightening mobile device management controls around the affected application surface.
Compensating controls are about shrinking the chance that crafted traffic can reach vulnerable parsing logic. That means reducing attack surface, limiting untrusted network exposure, and ensuring that endpoint protections and mobile telemetry remain enabled so any exploitation attempt leaves a visible trail.
Detection and Identity Impact After Exploitation
Because this vulnerability can lead to remote code execution, defenders should treat compromise review as broader than a crash investigation. Review device logs, network telemetry, unusual application behaviour, and any signs that the messaging app or the underlying OS was used as an entry point for follow-on activity.
If exploitation is suspected, check whether the device’s messaging sessions, call context, or any linked accounts may have been exposed through post-compromise access. If the endpoint was used to access other services, rotate any credentials, tokens, or session material that could have been captured after execution, and validate that no persistence was added on the device.
Risk and Threat Considerations
This vulnerability matters because it gives an attacker a network-reachable route from a crafted protocol exchange to code execution on a target phone. That combination is high risk in a widely used communications app because the exploit can be delivered remotely and may not require the user to complete an obvious malicious action.
Failure mechanism: Memory corruption in the VOIP stack can let hostile input overwrite process state, alter control flow, and execute attacker-chosen code.
Impact: Successful exploitation can lead to device compromise, follow-on access to messages or accounts, and broader organisational exposure if the phone is tied to business communications.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Validates untrusted inputs to stop malformed network data from corrupting memory. |
| SI-2 — Flaw Remediation | Requires timely remediation of exploited software flaws affecting endpoints and apps. | |
| Recommendation — Apply SI-10 to validate parsed VoIP and RTCP inputs before they reach vulnerable code paths. Use SI-2 to prioritise and verify remediation for the WhatsApp vulnerability. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Covers identifying and remediating exploited vulnerabilities across managed assets. |
| Recommendation — Use CIS-7 to inventory affected devices and accelerate remediation of exploited WhatsApp builds. | ||
| OWASP ASVS | V5 — File Handling | Covers safe handling of untrusted input and malformed data that can trigger memory corruption. |
| Recommendation — Apply V5 to ensure untrusted media-processing inputs are handled safely. | ||
| MITRE ATT&CK | T1203 — Exploitation for Client Execution | Captures exploitation of a client application to run attacker-controlled code. |
| Recommendation — Map exploitation attempts to T1203 and hunt for malicious client-side execution. | ||
Practitioner Guidance
Why practitioners should care: Treat this class of vulnerability as a priority remote-code-execution issue, not a low-severity client bug. In mobile communications software, the operational impact can extend beyond the app itself because the device often stores authentication material and serves as a trusted communications endpoint.
What to watch for: Focus on exposure in fleets where the application is present, where call traffic is allowed from untrusted networks, and where patch rollout is delayed. If exploitation is suspected, investigate both the endpoint and any adjacent accounts or services that depended on that device for access.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org