A security flaw affecting WhatsApp Desktop for Windows could allow attackers to trick users into executing malicious code through specially crafted file attachments.
Facebook, which owns WhatsApp, disclosed the issue under CVE-2025-30401, urging users to install the latest update of the client app immediately.
The vulnerability is a spoofing issue in the way WhatsApp for Windows handled file attachments. While the application correctly interpreted attachments using their MIME type for display, it relied on the file extension to determine which program would open the file when accessed manually from within WhatsApp. This discrepancy opened the door to attacks where a user could be shown an innocuous file type (like an image or document) but, upon opening, execute an entirely different file type, potentially leading to arbitrary code execution.
This kind of mismatch between MIME type and file extension is a classic method for social engineering-based exploitation. A threat actor could send a file that appears as a harmless image, such as photo.jpg, but is actually an executable file (photo.jpg.exe) masked with misleading metadata. If a victim double-clicks the attachment within WhatsApp, the underlying executable could run, compromising the user's system.
The issue affects all versions of WhatsApp Desktop for Windows from version 0.0.0 up to (but not including) 2.2450.6. The latest version, 2.2450.6, resolves the flaw by ensuring file execution behavior aligns strictly with the MIME type and content verification processes.
WhatsApp Desktop is a widely used client for the popular messaging platform, providing end-to-end encrypted messaging across multiple platforms. While the desktop version is generally considered secure, flaws like CVE-2025-30401 highlight the continued need for rigorous validation, especially when dealing with file attachments and user interactions.
Facebook's bulletin notes that systems are “unaffected by default,” meaning exploitation requires some level of user interaction, such as manually opening a suspicious file. However, given the widespread reliance on messaging apps for personal and professional communication, the exploitation potential for CVE-2025-30401 remains significant.
Users of WhatsApp for Windows should update to version 2.2450.6 or later without delay and avoid opening unexpected or suspicious files from within the app. Also, ensure that Windows is configured to display the full file extensions to help spot deceptive names.
CVE-2025-30401