Do WeChat users need to update to be safe from WeWorm?

No action is required. Tencent published WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21, 2026, then mitigated the exploit server-side for every user, and stated the fix is live for all users with no app update or other step needed. Calif confirmed the exploit was blocked for all users by August 28, 2026.

Was WeWorm ever used against real WeChat users?

Tencent reported no evidence of real-world exploitation of the WeChat VoIP bug behind WeWorm. Calif built the worm as a demonstration, reported the vulnerability privately on July 24, 2026, and held public disclosure until September 8, 2026, after the patches had shipped and the server-side mitigation was already in place.

Could declining the call stop WeWorm?

Declining a WeWorm call within a few seconds prevented infection, according to Calif. Answering it did not help: victims who picked up heard nothing at all while the exploit ran, and simply letting the phone keep ringing was enough for the takeover to succeed. That is what makes WeWorm a zero-click attack rather than a phishing-style one.

Does WeWorm have a CVE identifier?

Calif's WeWorm disclosure names no CVE for the WeChat VoIP memory-corruption bug. The research post identifies the flaw by its behaviour and by the patched WeChat builds — Android 8.0.77 and iOS 8.0.76 — rather than by a public vulnerability identifier, so defenders tracking it should key on the app version instead of a CVE number.

How many people could WeWorm have reached?

WeChat has more than 1.4 billion monthly active users, overwhelmingly in China, and WeWorm spread to anyone on a compromised account's friends list. Calif wrote that an attacker exploiting the flaw could have compromised over a billion phones or accounts before Tencent's August 2026 patches and server-side mitigation closed it.

Calif · 2026-09-08 · major

WeWorm — AI found a WeChat bug that spreads with one call

WeWorm is a demonstration worm that spread through WeChat calls on iOS and Android without the victim touching the phone. Calif used AI to find the memory-corruption bug and write a working exploit in about two days.

WeWorm research graphic from the security firm Calif

AI found the WeChat bug and wrote the exploit in about two days; the worm took one more week.

Key specs

We chat monthly users	1.4 billion

Quick facts

Researchers	Calif
Affected app	WeChat on iOS and Android
Bug type	Memory corruption in the VoIP stack
Time to first RCE exploit	About two days, with AI
Reported to Tencent	July 24, 2026
Patched	Android 8.0.77 and iOS 8.0.76, August 21, 2026
Exploited in the wild	No evidence found

What is it?

WeWorm is a demonstration worm from the security firm Calif that spreads between phones through WeChat calls, on both iOS and Android. A victim never has to answer or touch the device — the account is taken over while the phone rings. Declining the call within a few seconds was the only thing that stopped infection.

How does it work?

The chain starts with a memory-corruption bug in WeChat's VoIP stack, which gives an attacker already on the victim's friends list remote code execution and full control of the account. From there the compromised account calls its own contacts and the cycle repeats. Calif reports that exploitation takes only seconds and lets the attacker read and send messages, place calls and act as the victim; the team demonstrated the worm on an iPhone 17e and a Pixel 10a.

Why does it matter?

The timeline is the real story. Calif says AI found the flaw in July 2026 and produced the first remote-code-execution exploit in about two days, with the full cross-platform worm taking one more week — work that used to need a bigger team and many months. Tencent shipped fixes on August 21, 2026 and reports no sign of real-world exploitation, but the same speed-up is now within reach of far less skilled attackers.

Who is it for?

security teams and mobile developers

Frequently asked questions

Do WeChat users need to update to be safe from WeWorm?: No action is required. Tencent published WeChat 8.0.77 for Android and 8.0.76 for iOS on August 21, 2026, then mitigated the exploit server-side for every user, and stated the fix is live for all users with no app update or other step needed. Calif confirmed the exploit was blocked for all users by August 28, 2026.
Was WeWorm ever used against real WeChat users?: Tencent reported no evidence of real-world exploitation of the WeChat VoIP bug behind WeWorm. Calif built the worm as a demonstration, reported the vulnerability privately on July 24, 2026, and held public disclosure until September 8, 2026, after the patches had shipped and the server-side mitigation was already in place.
Could declining the call stop WeWorm?: Declining a WeWorm call within a few seconds prevented infection, according to Calif. Answering it did not help: victims who picked up heard nothing at all while the exploit ran, and simply letting the phone keep ringing was enough for the takeover to succeed. That is what makes WeWorm a zero-click attack rather than a phishing-style one.
Does WeWorm have a CVE identifier?: Calif's WeWorm disclosure names no CVE for the WeChat VoIP memory-corruption bug. The research post identifies the flaw by its behaviour and by the patched WeChat builds — Android 8.0.77 and iOS 8.0.76 — rather than by a public vulnerability identifier, so defenders tracking it should key on the app version instead of a CVE number.
How many people could WeWorm have reached?: WeChat has more than 1.4 billion monthly active users, overwhelmingly in China, and WeWorm spread to anyone on a compromised account's friends list. Calif wrote that an attacker exploiting the flaw could have compromised over a billion phones or accounts before Tencent's August 2026 patches and server-side mitigation closed it.