CVE-2023-38537: 
NixOS vulnerability analysis and mitigation

A race condition vulnerability (CVE-2023-38537) was discovered in WhatsApp's network transport subsystem that led to a heap use-after-free issue. The vulnerability specifically affects established or unsilenced incoming audio/video calls and was disclosed in October 2023. The issue impacts WhatsApp Desktop for Mac OS X versions up to (excluding) 2.2338.12 (NVD, CVE).

The vulnerability is characterized as a race condition in the network transport subsystem that results in a heap use-after-free condition. It received a CVSS v3.1 Base Score of 5.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) (NVD).

If successfully exploited, this vulnerability could result in application termination or unexpected control flow, though with a very low probability. The impact affects confidentiality, integrity, and availability, each at a low level according to the CVSS scoring (NVD).

The vulnerability requires network access and has high attack complexity. No authentication or user interaction is required for exploitation. However, the probability of successful exploitation is noted to be very low (NVD).

The vulnerability has been addressed in WhatsApp Desktop for Mac OS X version 2.2338.12 and later versions (NVD).