{"advisories":[{"id":"EUVD-2025-6755","source":"euvd","title":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-6755"}],"cve":"CVE-2025-30259","epss":{"score":0.00256},"mitre":{"cpes":[],"created":"2025-03-19T00:00:00+00:00","description":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/30xxx/CVE-2025-30259.json","references":["https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/","https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/"],"title":null,"updated":"2025-03-20T20:36:29.389000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2025-03-20T00:15:13.780000+00:00","description":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-30259.json","references":["https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/","https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/"],"title":null,"updated":"2026-06-17T09:08:24.910000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2025-03-20T00:00:00+00:00","data":[{"details":{"new":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","old":null},"type":"description"},{"details":{"added":["https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/","https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"6a1d7dcd-6154-4144-a51f-ee4cf23ddfb8"},{"created":"2025-03-20T00:15:00+00:00","data":[{"details":{"added":{},"removed":{},"updated":{"cvssV3_1":{"new":{"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"},"old":{"score":3.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L"}}}},"type":"metrics"}],"id":"485c7573-515b-433b-9dbe-534c7a6327ac"},{"created":"2025-03-20T21:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"ff187b8b-12cf-4006-aeb9-8b44730ef2b2"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2025-03-19T00:00:00+00:00","provider":"mitre"},"description":{"data":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00256},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/","https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2026-04-15T00:35:42.020000+00:00","provider":"nvd"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":[],"providers":[]}},"vulnrichment":{"cpes":[],"created":"2025-03-19T00:00:00+00:00","description":"The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2025-03-20T20:36:25.533000+00:00","vendors":[],"vulnrichment_repo_path":"2025/30xxx/CVE-2025-30259.json","weaknesses":[]}}