WhatsApp for Windows before version 2.3000.1032164386.258709 can display a maliciously crafted document that contains NULL bytes in the filename as one file type, yet run it as an executable when the user opens the attachment. The vulnerability allows an attacker to trick a user into executing arbitrary code by manipulating the file extension presentation. This flaw represents a type confusion error that could lead to loss of confidentiality, integrity, and availability if abused.

The affected system is the Windows desktop client for WhatsApp. Users running any pre‑v2.3000.1032164386.258709 installation on Windows devices are impacted. No specific hardware or operating version constraints are noted beyond the pre‑specified application version.

The CVSS score of 6.5 indicates a moderate risk level, and the EPSS score is not available, implying uncertain exploitation likelihood. Because the weakness involves file handling, an attacker would need to deliver a crafted attachment that the user opens. The vulnerability is not listed in CISA KEV, and no exploitation evidence has yet been observed in the wild. However, the potential for remote execution remains, especially if users click on convincingly disguised attachments.