CVE-2023-38537: 
WhatsApp vulnerability analysis and mitigation

A race condition vulnerability (CVE-2023-38537) was discovered in WhatsApp's network transport subsystem that led to a heap use-after-free issue. The vulnerability specifically affects established or unsilenced incoming audio/video calls and was disclosed in October 2023. The issue impacts WhatsApp Desktop for Mac OS X versions up to (excluding) 2.2338.12 (NVD, CVE).

The vulnerability is characterized as a race condition in the network transport subsystem that results in a heap use-after-free condition. It received a CVSS v3.1 Base Score of 5.6 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) (NVD).

If successfully exploited, this vulnerability could result in application termination or unexpected control flow, though with a very low probability. The impact affects confidentiality, integrity, and availability, each at a low level according to the CVSS scoring (NVD).

The vulnerability has been addressed in WhatsApp Desktop for Mac OS X version 2.2338.12 and later versions (NVD).