Meta has issued a warning to all Windows users to update their WhatsApp app to the latest version after a serious security vulnerability was discovered.
This flaw, tracked as CVE-2025-30401, could allow attackers to run harmful code on a victim’s computer by sending a specially crafted file.
The bug is described as a spoofing issue. It tricks the app into showing a file type based on its MIME type while executing it based on the file extension. In simpler terms, a user might think they’re opening a harmless file but could end up running malicious code instead. Meta fixed this issue in WhatsApp version 2.2450.6 for Windows.
“A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code,” Meta said in its security advisory.
This flaw was reported by an independent researcher through Meta’s bug bounty program. It’s still unknown if this bug has been used in real attacks.
WhatsApp has become a common target for spyware attacks. Last year, researchers discovered a zero-click, zero-day exploit that allowed the Graphite spyware to be installed silently. Meta responded quickly by fixing it on the server side without needing an app update.
In another major case, court documents revealed that the NSO Group used zero-day flaws in WhatsApp to install Pegasus spyware on over 1,400 devices, targeting journalists and activists. The U.S. court found this action violated federal hacking laws.
To stay safe, Meta urges all users to update to the latest version of WhatsApp on Windows as soon as possible.
