The vulnerability arises from incomplete validation of AI rich response messages that contain Instagram Reels references within WhatsApp. This oversight, identified as CWE-940, allows a malicious user to craft a message that triggers the victim’s device to fetch and process media content from an external URL. In some cases, the media content may invoke OS‑controlled custom URL scheme handlers, potentially executing arbitrary code or launching unintended applications. The CVSS score of 4.3 indicates moderate impact and a non‑zero but limited likelihood of exploitation.

Affected deployments are WhatsApp for iOS versions from 2.25.8.0 through 2.26.15.72 and WhatsApp for Android versions from 2.25.8.0 through 2.26.7.10. Both products are distributed by Facebook.

The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. This suggests that, so far, no exploitation in the wild has been documented. Nonetheless, the vulnerability could be exploited by a social‑engineering attacker who is able to deliver a crafted AI rich response to a victim. The attack vector is inferred to involve sending a malicious media link from another user, so the risk is considered moderate.