Zoom VDI Client CVE-2026-53416

Exploitation requires an authenticated session with at least low-privilege access (PR:L) on the host running Zoom VDI Client or Plugins, consistent with the CVSS vector AV:L/PR:L. The attacker must be able to supply or manipulate path inputs processed by the VDI client or plugin - the specific feature or API endpoint that accepts these paths is not detailed in available data. Exploitation is local-only (AV:L), meaning remote unauthenticated attackers cannot directly trigger this flaw. Limiting factors include: the requirement for an existing authenticated local session, no network-facing attack surface implied by the vector, and no exploitation automation path visible from available data. Defenders should assess risk in the context of who holds local or VDI session access on affected endpoints.

The CVSS 3.1 score of 7.1 (High) is driven by AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - low-complexity local exploitation requiring only low-privilege credentials, with no user interaction, and resulting in high confidentiality and integrity impact but no availability loss. The local attack vector (AV:L) is the primary risk-limiting factor: an attacker must already have an interactive session or shell on the VDI endpoint, which confines the realistic threat to insider abuse, compromised thin-client endpoints, or lateral movement following initial access. EPSS data was not supplied, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public proof-of-concept reported, which further depresses near-term exploitation probability. The C:H/I:H combination is notable - a successful traversal enabling both reads and writes could allow exfiltration of sensitive files or tampering with application data within the VDI session, representing a meaningful post-compromise escalation primitive. Risk is best framed as an insider-threat or lateral-movement-phase concern rather than a direct remote attack risk.

An authenticated user with a low-privilege account on a VDI endpoint crafts a malicious path input within the Zoom VDI Client or Plugin interface, using directory traversal sequences to escape the application's intended file scope. The attacker reads sensitive files outside the designated directory - such as configuration files, credentials, or user data - or writes arbitrary content to tamper with application state. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the mechanics are straightforward once local access is established.