Is CVE-2020-1903 actively exploited?

No active exploitation of CVE-2020-1903 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-1903 be exploited remotely?

No. CVE-2020-1903 requires local access to exploit.

What is the CVSS score of CVE-2020-1903?

CVE-2020-1903 has a CVSS score of 5.5 (MEDIUM).

HOME VULNERABILITIESCVE-2020-1903

MEDIUM

CVE-2020-1903

CWE-400Published: October 6, 2020· Updated: Jun 17, 2026

5.5

CVSS v3.1

Official Description

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.

NVD Source

Technical Analysis

CVE-2020-1903 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 5.5.