Check Point says critical vulnerability found in Instagram, issue fixed

Security firm Check Point on Thursday said its researchers had found a vulnerability on the Instagram app that could have allowed an attacker to take over a victim's account using a malicious image - an issue which has now been fixed.

Earlier this year, Check Point researchers had found a critical vulnerability in the Instagram app that would have given an attacker the ability to take over a victim's Instagram account, and turn their phone into a spying tool by sending them a malicious image file, Check Point said in a statement.

When the image is saved and opened in the Instagram app, the exploit would have given the hacker full access to the victim's Instagram messages and images, allowing them to post or delete images at will, as well as giving access to the phone's contacts, camera and location data, it added.

When contacted, a Facebook spokesperson said: "Check Point's report overstates a bug, which we fixed quickly and have no reason to believe impacted anyone. Through their own investigation Check Point was unable to successfully exploit this bug."

Check Point also noted that it had disclosed its findings to Facebook and the Instagram team.

"Facebook's advisory was very responsive and helpful, they have described this vulnerability as an 'Integer Overflow leading to Heap Buffer Overflow' and issued a patch to remediate the issue on the newer versions of the Instagram application on all platforms," it said.

Check Point added that the patch for this vulnerability has already been available for six months now, giving time to the majority of users to update their Instagram app, thus mitigating the risk of this vulnerability being exploited.

"We strongly encourage all Instagram users to ensure they are using the latest Instagram app version and to update if any new version is available," it said.