Spoofing Vulnerability in WhatsApp Desktop for Windows
Summary
Be careful when you open that file in whatapp, it might have that spoofing flaw allowing Arbitrary Code Execution (CVE-2025-30401) and affects all versions of WhatsApp Desktop for Windows prior to 2.2450.6, and stems from a bug .
Overview
The vulnerability has been fixed in version 2.2450.6. WhatsApp has and will always be an attractive field for attackers and this particular bug does require user interaction – the victim has to manually open the malicious attachment for the payload to run.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Spoofing Vulnerability | CVE-2025-30401 | WhatsApp Desktop for Windows | Medium | 2.2450.6 |
Technical Summary
The vulnerability results from WhatsApp for Windows’s different handling of attachments. It opens files depending on their filename extension while displaying files based on their MIME type. This mismatch allows attackers to spoof file types and trick users into launching malicious executables.
Example Scenario:
An attacker sends a file named cat.jpg.exe with a MIME type of image/jpeg. WhatsApp displays the file as an image (because of the MIME type), misleading the user. If the user manually opens the attachment from within WhatsApp, Windows uses the .exe extension to execute the file — potentially launching malicious code.
This form of UI spoofing can be especially effective in group chats, where malicious attachments may be distributed widely and appear harmless.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-30401 | WhatsApp Desktop for Windows (<2.2450.6) | MIME type used for display, but file extension used for execution. A mismatch between the two could allow a file to appear harmless (e.g., image), while actually being executable (e.g., .exe). | Remote Arbitrary code execution |
Remediation:
- Official Patch Available: The vulnerability has been resolved by Meta (formerly Facebook). Users should update WhatsApp for Windows to version 2.2450.6 or latest version.
Conclusion:
CVE-2025-30401 is a key example of how inconsistent file processing in the user interface can result in serious security threats. Attackers can create misleading payloads that can run arbitrary code by taking advantage of users’ faith in how apps display attachments.
Due to the possibility of remote exploitation, users should update to the latest WhatsApp version 2.2450.6 or later. Patching should be done right away to avoid any compromise.
Be careful when you click attachments.
References: