EUVD-2026-45045
GHSA-vgcc-2r5p-6qvc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as local low-priv user
-
DeliveryTrigger or await Zoom install/uninstall
-
ExploitWin TOCTOU race on validated resource
-
ExecutionRedirect operation to attacker-controlled content
-
PersistPrivileged installer executes as SYSTEM
-
ImpactEscalate to full host control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Exploitation requires an authenticated local user (PR:L) with the ability to run code on the target Windows host and to interact with the filesystem while a Zoom Client installation or uninstallation is in progress - the install/uninstall flow is the exact feature that must be executing for the TOCTOU window to exist. Limiting factors: the attacker must already have local access and low-level privileges (not remote, not unauthenticated), must win a race condition (AC:H) which is timing-sensitive and may require many attempts, needs no user interaction (UI:N) beyond triggering or coinciding with an install/uninstall, and only 'certain' Zoom Windows client versions are affected. It does not apply to non-Windows clients and cannot be triggered remotely. |
| Impact | The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0 High) tells a consistent story: an already-authenticated local user with low privileges can, if they win a timing-sensitive race (AC:H), achieve full confidentiality/integrity/availability impact on the host. There is no EPSS score, no KEV listing, and no POC in the provided data, so real-world exploitation pressure appears low today - this is a defense-in-depth/patch-hygiene priority rather than an emergency. The AC:H (race condition) meaningfully limits reliability: TOCTOU wins are often non-deterministic and may require many attempts or specific timing, so mass or automated exploitation is unlikely. No conflicting signals were found between the vector and the description - both agree on local, authenticated, high-impact EoP. Missing data: precise affected versions, patched version number, and independent POC status are all unknown from the single NVD reference provided. |
| Exploit ScenarioDerived | A logged-in standard user on a shared or corporate Windows workstation triggers (or waits for) a Zoom install or uninstall that runs with elevated privileges, then races the setup process - swapping a file or redirecting a path between the privileged process's validity check and its use - to have the elevated process act on attacker-controlled content and execute code as SYSTEM. Because AC:H reflects a timing-sensitive race, the attacker likely automates repeated attempts to win the window. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Local privilege escalation in certain Zoom Clients for Windows lets an authenticated local user exploit a time-of-check to time-of-use (TOCTOU) race during install/uninstall to gain higher privileges (likely SYSTEM). The flaw was reported by Zoom's own security team and is documented in bulletin ZSB-26012; no public exploit identified at time of analysis and it is not on CISA KEV. The high-complexity race window and local-access requirement temper an otherwise high-impact (C:H/I:H/A:H) issue.
RemediationAI
Update to the fixed Zoom Client for Windows release identified in Zoom Security Bulletin ZSB-26012 (https://www.zoom.com/en/trust/security-bulletin/zsb-26012); the exact fixed version is not present in the provided data, so confirm it directly from that advisory before deploying - Patch available per vendor advisory. As compensating controls until patched: restrict who can run install/uninstall operations by removing local administrator rights and enforcing least privilege so untrusted users cannot stage race conditions; centralize Zoom deployment/updates through managed software distribution (SCCM/Intune) rather than allowing per-user installs, which reduces the window in which an interactive user can interfere with installer file operations; and monitor for suspicious file/junction manipulation in temp and installer directories during Zoom setup. Trade-off: locking down local admin and install rights may disrupt users who self-manage Zoom updates, so pair it with a managed auto-update path.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-367 (Time-of-check Time-of-use race condition): the Windows installer/uninstaller validates a resource (e.g., a file path, permission, or link target) at one moment and then acts on it at a later moment, allowing an unprivileged local process to swap or redirect that resource in the interval. Because Windows installer and uninstaller flows for Zoom run with elevated privileges (typically as SYSTEM via the Windows Installer service or an elevated setup binary), winning the race lets attacker-controlled content be operated on by a privileged process - a classic elevation-of-privilege primitive on Windows involving file operations, junctions/symlinks, or DLL/path handling during MSI custom actions. Exact affected build ranges are not enumerated in the provided data (no CPE strings supplied); the vendor scopes it to 'certain Zoom Clients for Windows.'
Know when Zoom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) must win a timing-sensitive race (AC:H); winning yields SYSTEM-level EoP, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (zoom).
CVSS VectorVendor: zoom
DescriptionCVE.org
A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.
Executive ViewAI
A privilege escalation vulnerability in Zoom Client for Windows (CVE-2026-53410) allows authenticated local users to gain SYSTEM-level access, creating direct risk for credential compromise and lateral movement on Windows endpoints. With no vendor patch currently available, organizations must immediately implement access controls to restrict exploitation opportunities. The local-access and local-authentication requirement limits exposure scope but does not eliminate risk on shared workstations or systems without enforced single-user access.
No vendor-released patch identified at time of analysis. Interim mitigations: disable user-initiated software uninstallation via Group Policy or MDM; restrict local administrative access on systems running Zoom; implement privilege escalation monitoring via Windows Security Logs (Event ID 4688); segregate Zoom installations to single-user or administratively-managed endpoints where feasible; maintain version inventory and monitor ZSB-26012 bulletin for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when c
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including anima
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary cod
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages incl
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-134
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during install
Video Conferencing with Zoom WordPre versions up to 4.6.6 is affected by improper authentication (CVSS 7.5).
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC e
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of a
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Rated high severity (CVS
Exploit-DB