Zoom Rooms EUVD-2026-45044

Exploitation requires local, authenticated access to a Windows host running Zoom Rooms prior to version 7.1.0 (AV:L, PR:L) - the attacker must already possess a valid low-privileged local account or session. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the vulnerability cannot be triggered remotely or over the network, is confined to the Windows Zoom Rooms client, and is remediated in 7.1.0, so patched or non-Windows deployments are not exploitable via this issue.

The signals are moderately concerning but not urgent. The CVSS 3.1 base score of 7.8 (High) reflects local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and high impact across C/I/A - a classic full-takeover local EoP profile. However, the local vector meaningfully bounds real-world risk: an attacker must already have authenticated local access to the Windows host. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV and POC signals means there is no public exploit identified at time of analysis. This is a legitimate patch-management priority for organizations running Zoom Rooms on shared or multi-user Windows machines, but it is not a remotely exploitable, mass-scannable threat.

An attacker with an ordinary authenticated local account on a Windows machine running a vulnerable Zoom Rooms client (for example, a shared conference-room PC or a lightly restricted kiosk) interacts with a locally exposed, over-privileged Zoom Rooms component to abuse improper privilege management. With low attack complexity and no user interaction required, they escalate to higher privileges and gain full control (C:H/I:H/A:H) of the host. No public exploit code was identified at time of analysis.