A critical vulnerability has been discovered in Facebook Messenger for iOS, affecting group calls. The flaw allows attackers to disrupt group calls by exploiting emoji reactions. This denial-of-service (DoS) bug was identified in version 472.0.0 and analyzed in version 477.0.0. The vulnerability has since been patched.
The vulnerability highlights the risks of unencrypted group chats, which initially lack end-to-end encryption (E2EE). Messenger introduced default E2EE for chats and calls in December 2023. However, group chats remain unencrypted, allowing access to features like emoji reactions during group calls. This vulnerability was triggered by sending an invalid emoji reaction during group calls.
