You higher replace WhatsApp proper now. A researcher has found a nasty vulnerability within the Fb-owned privacy-oriented messenger that made it potential to for attackers to achieve entry to your information and messages ⁠— by sending you a malicious GIF.

The hazard stems from a double-free bug in WhatsApp, in line with a researcher going by the nickname Woke up. For these unfamiliar with the time period, a double-free vulnerability refers to a reminiscence corruption anomaly that would crash an app, or worse ⁠— open up an exploit vector that attackers can abuse to acquire entry to your gadget. All it takes to carry out the assault is to craft a malicious GIF, and trick a person into loading it.

In a technical write-up on GitHub, the researcher explains the flaw resided in WhatsApp‘s Gallery view implementation, which is used to generate previews for photographs, movies, and GIFs.

The exploit appears to have an effect on primarily Android units. “The exploit works properly for Android 8.1 and 9.0, however doesn’t work for Android 8.Zero and under,” Woke up writes. “Within the older Android variations, double-free may nonetheless be triggered. Nonetheless, […] the app simply crashes earlier than reaching to the purpose that we may management the PC register.”

The researcher has already notified Fb of this shortcoming, and the corporate has since mounted the problem. To guard your self in opposition to the exploit, you need to obtain the newest model of the app.

“Fb acknowledged and patched it formally in WhatsApp model 2.19.244. WhatsApp customers, please do replace to newest WhatsApp model (2.19.244 or above) to do away with this bug,” the researcher urged customers in his weblog put up.

Not a primary for WhatsApp

That is hardly the primary time WhatsApp has handled probably dangerous flaws in its software program.

Earlier this yr, the Monetary Instances reported a vulnerability within the messaging app allowed attackers to slide in spy ware on customers’ units. WhatsApp rushed to repair the problem, however didn’t make clear what number of customers had been affected by this loophole.

Extra lately, researchers discovered a kink in WhatsApp that made it potential to control or spoof messages.

It stays unclear if attackers had been capable of exploit the double-free vulnerability within the wild, however we’ve reached out to Fb for a clarification, and can replace this piece accordingly if we hear again.

For a extra technical breakdown of the now-patched exploit in WhatsApp, head to this web page.