Zoom Workplace VDI Plugin CVE-2026-53411

Exploitation requires three simultaneous conditions: (1) an authenticated local user account on the target Windows machine (PR:L per CVSS - not unauthenticated); (2) an affected Zoom Workplace VDI Plugin version prior to 6.6.14 must be installed; and (3) a Zoom installation or uninstallation operation must be actively in progress, as the race condition window only exists during these installer lifecycle events. The attacker cannot independently trigger the privileged installer process - they must observe and race an existing administrator-initiated install or uninstall. Exploitation is exclusively Windows-scoped (the CPE and description specify Windows platform). The high attack complexity (AC:H) reflects that winning the race condition requires precise timing, limiting exploitation to scenarios where the attacker has persistent local presence and can repeatedly attempt the race. No special Zoom configuration or non-default feature enablement is required beyond the product being installed.

The vendor-assigned CVSS 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the attack profile: local access and an authenticated session are required (AV:L, PR:L), and high complexity (AC:H) captures the inherent difficulty of winning a race condition against a precisely timed event. These friction points significantly reduce real-world risk. EPSS at 0.14% (4th percentile) and SSVC's 'Exploitation: none, Automatable: no' converge with the CVSS complexity rating - this attack cannot be scripted and fired at scale. SSVC's 'Technical Impact: total' is consistent with C:H/I:H/A:H, confirming that a successful exploit yields full system compromise, but this theoretical ceiling is tempered by the practical difficulty. The net assessment is medium-low operational priority: organizations running Zoom VDI in environments with untrusted local users (shared workstations, VDI endpoints accessible by lower-trust staff) should patch promptly, but this does not require emergency response for most enterprise deployments. No data conflicts are present; all signals are internally consistent.

An authenticated local user on a Windows VDI endpoint monitors for an administrator-initiated Zoom Workplace VDI Plugin installation or uninstallation event. During the brief interval between the installer's resource check and its subsequent use under elevated privileges, the attacker races to place a symlink or malicious file at the expected path, causing the SYSTEM-context installer process to operate on attacker-controlled content. No public proof-of-concept code exists for this vulnerability, and successful exploitation requires precise timing coordination with a privileged installation event, making opportunistic or automated attacks impractical.