A picture is worth a thousand words, but a GIF is worth a thousand pictures.
Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight.
But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone?
Well, not a theoretical idea anymore.
WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages.
WhatsApp Remote Code Execution Vulnerability
The vulnerability, tracked as CVE-2019-11932, is a double-free memory corruption bug that doesn’t actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that WhatsApp uses.
Discovered by Vietnamese security researcher Pham Hong Nhat in May this year, the issue successfully leads to remote code execution attacks, enabling attackers to execute arbitrary code on targeted devices in the context of WhatsApp with the permissions the app has on the device.
How Does WhatsApp RCE Vulnerability Work?
WhatsApp uses the parsing library in question to generate a preview for GIF files when users open their device gallery before sending any media file to their friends or family.
Thus, to be noted, the vulnerability does not get triggered by sending a malicious GIF file to a victim; instead it gets executed when the victim itself simply opens the WhatsApp Gallery Picker while trying to send any media file to someone.