{
    "id": "CVE-2019-11932",
    "published": "2019-10-03 22:15:10",
    "last_modified": "2026-06-17 02:13:51",
    "cvss_score": "8.8",
    "cvss_severity": "HIGH",
    "cvss_version": "3.1",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "cwe": "CWE-415",
    "description": "A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version 2.19.244 and many other Android applications, allows remote attackers to execute arbitrary code or cause a denial of service when the library is used to parse a specially crafted GIF image.",
    "epss_score": "0.44530",
    "epss_percentile": "0.98726",
    "kev": 0,
    "kev_due": null,
    "has_exploit": 1,
    "updated_at": "2026-09-27 18:17:22",
    "priority": {
        "rank": 2,
        "label": "Patch early",
        "why": "A public exploit exists."
    },
    "products": [
        {
            "vendor": "android-gif-drawable_project",
            "product": "android-gif-drawable"
        },
        {
            "vendor": "whatsapp",
            "product": "whatsapp"
        }
    ],
    "kev_detail": null,
    "exploits": [
        {
            "source": "exploit-db",
            "ref_id": "47515",
            "title": "Whatsapp 2.19.216 - Remote Code Execution",
            "date": "2019-10-16",
            "url": "https://www.exploit-db.com/exploits/47515"
        }
    ],
    "refs_list": [
        "http://packetstormsecurity.com/files/154867/Whatsapp-2.19.216-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/158306/WhatsApp-android-gif-drawable-Double-Free.html",
        "http://seclists.org/fulldisclosure/2019/Nov/27",
        "https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/",
        "https://gist.github.com/wdormann/874198c1bd29c7dd2157d9fc1d858263",
        "https://github.com/koral--/android-gif-drawable/commit/cc5b4f8e43463995a84efd594f89a21f906c2d20",
        "https://github.com/koral--/android-gif-drawable/pull/673",
        "https://github.com/koral--/android-gif-drawable/pull/673/commits/4944c92761e0a14f04868cbcf4f4e86fd4b7a4a9",
        "https://www.facebook.com/security/advisories/cve-2019-11932",
        "http://packetstormsecurity.com/files/154867/Whatsapp-2.19.216-Remote-Code-Execution.html",
        "http://packetstormsecurity.com/files/158306/WhatsApp-android-gif-drawable-Double-Free.html",
        "http://seclists.org/fulldisclosure/2019/Nov/27",
        "https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/",
        "https://gist.github.com/wdormann/874198c1bd29c7dd2157d9fc1d858263",
        "https://github.com/koral--/android-gif-drawable/commit/cc5b4f8e43463995a84efd594f89a21f906c2d20",
        "https://github.com/koral--/android-gif-drawable/pull/673",
        "https://github.com/koral--/android-gif-drawable/pull/673/commits/4944c92761e0a14f04868cbcf4f4e86fd4b7a4a9",
        "https://www.facebook.com/security/advisories/cve-2019-11932"
    ]
}