WhatsApp users alert! Bug in image filter may have exposed your data, vulnerability now fixed

New Delhi: A bug in WhatsApp's image filter function could have exposed your data to hackers. The vulnerability, which was first flagged by Check Point Research (CPR), has now been fixed by the social messaging platform. 

CPR on Thursday said it had flagged a security vulnerability in WhatsApp's image filter function that could have been exploited by attackers to read sensitive information, and the same has now been fixed by the messaging platform.

"CPR exposed a security vulnerability in WhatsApp...An attacker could have exploited the vulnerability to read sensitive information from WhatsApp memory," CPR said in a statement.

It added that the vulnerability was rooted in WhatsApp's image filter function and during its research study, CPR learned that switching between various filters on crafted GIF files caused WhatsApp to crash.

"CPR identified one of the crashes as memory corruption. CPR promptly reported the problem to WhatsApp, who named for the vulnerability CVE-2020-1910, detailing it as an out-of-bounds read and write issue," it noted.

Successful exploitation of the vulnerability would have required an attacker to apply specific image filters to a specially crafted image and send the resulting image, it added.

“With over two billion active users, WhatsApp can be an attractive target for attackers. Once we discovered the security vulnerability, we quickly reported our findings to WhatsApp, which was cooperative and collaborative in issuing a fix. The result of our collective efforts is a safer WhatsApp for users worldwide,” Check Point Head of Products Vulnerabilities Research Oded Vanunu said.

When contacted, a WhatsApp spokesperson said the company regularly works with security researchers "to improve the numerous ways WhatsApp protects people's messages, and we appreciate the work that Check Point does to investigate every corner of our app". Also Read: Redmi 10 Prime, Redmi TWS Earbuds India launch today: When and where to watch live event

"People should have no doubt that end-to-end encryption continues to work as intended and people's messages remain safe and secure,? the spokesperson added. Also Read: Airtel rolls out 3 new Disney+ Hotstar recharge plans ahead of IPL 2021 Phase 2: Price, validity, benefits