Critical vulnerability in WhatsApp: Hackers can access iPhones through a photo

Experts at DarkNavyOrg have discovered a dangerous vulnerability in the WhatsApp messenger (owned by Meta Platforms Inc., designated an extremist organization in Russia), which allows hackers to remotely execute code on Apple devices. The attack requires no action from the victim, making it especially insidious, SecurityLab reports.

How Does the Vulnerability Work?

The problem is linked to two flaws:

1. CVE-2025-55177: a logical error in the handling of incoming messages. Due to the lack of source verification, hackers can send malicious code that the system accepts as legitimate.
2. CVE-2025-43300: a failure in the DNG file processing library. A specially crafted image triggers memory corruption, opening the door for code execution.

In a demonstration, researchers sent an infected photo to a target number and silently hacked the device. This allows attackers to:

• Gain full control over an iPhone, iPad, or Mac.
• Read chats and personal data.
• Install spyware.
• Conduct covert surveillance.

The danger lies in the fact that the victim does not need to open the photo or interact with the message — infection happens automatically.

Who Is at Risk?

The vulnerability affects devices running iOS, iPadOS, and macOS where WhatsApp is installed. The exact number of potential victims is unknown, but with billions of users, the threat is massive.

How to Protect Yourself?

While WhatsApp and Apple are preparing fixes, users can:

• Update WhatsApp to the latest version via the App Store.
• Update iOS, iPadOS, and macOS with the latest security patches.
• Avoid suspicious messages: although no interaction is required for the attack, caution with unknown contacts is advised.

Patches are expected in upcoming WhatsApp and Apple OS updates.

Why Does It Matter?

The flaw highlights risks even in protected ecosystems like iOS. The fact that no user interaction is needed makes the attack invisible, while potential access to personal data threatens privacy. It’s a reminder of the importance of timely updates and vigilance in the digital world.

In Short…

Critical vulnerabilities CVE-2025-55177 and CVE-2025-43300 allow hackers to compromise Apple devices through WhatsApp by sending a malicious photo. Users are strongly advised to update both the app and their operating system. Apple and WhatsApp are preparing patches, but vigilance remains the key to safety.