Zoom Workplace EUVD-2026-98754

Exploitation requires that the target be running a Zoom Workplace client with the Zoom Phone feature in use, and requires user interaction (UI:R) to trigger the crafted input that overflows the buffer. Attack complexity is High (AC:H), indicating conditions outside the attacker's control (e.g., timing, memory layout, or specific feature state) must be met, which materially limits reliable exploitation. The vendor vector indicates some privilege level is needed (PR:L), though the description claims an unauthenticated user - this prerequisite is unverified and should be confirmed with Zoom. These factors - required user interaction, high complexity, and dependence on the Zoom Phone feature being active - significantly constrain real-world exploitation despite network reachability.

The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) describes a network-reachable buffer overflow that crosses a scope boundary (S:C) and fully compromises confidentiality, integrity and availability, making it a genuinely serious client-side flaw rather than a high-score-but-low-impact issue. However, several real-risk-dampening signals are present: attack complexity is High (AC:H) and user interaction is Required (UI:R), both of which make reliable, at-scale exploitation harder. A direct conflict exists in the source data that MUST be flagged: the description states 'an unauthenticated user' can conduct the attack, yet the CVSS vector encodes PR:L (low privileges required) - these cannot both be true, so the real authentication requirement should be verified against Zoom bulletin ZSB-26020. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no evidence of active exploitation or available exploit code at this time. Net assessment: a credible, impactful client vulnerability warranting prompt patching for Zoom Phone users, but the AC:H + UI:R constraints and absence of KEV/EPSS/POC signals suggest it is not currently a mass-exploitation emergency.

An attacker delivers specially crafted network traffic to the Zoom Phone feature of a targeted user's Zoom Workplace client and induces the user to interact with it (UI:R), triggering a buffer overflow (CWE-120). Because exploitation requires high attack complexity (AC:H) and user interaction, a realistic scenario is a targeted lure against a specific user rather than broad opportunistic scanning. No public exploit code was identified in the provided data.