Zoom Clients
Monthly
Information disclosure in certain Zoom Clients' My Notes feature allows an on-path attacker who presents a fraudulent certificate to obtain feature-related data because the client fails to validate certificates properly. The vulnerability is remotely reachable without authentication or user interaction (AV:N/AC:H/PR:N/UI:N), but exploitability is constrained by the requirement to hold a man-in-the-middle position on the network path, and the independent assessment limits impact to confidentiality. No public exploit or confirmed active exploitation (CISA KEV) was identified, and no EPSS score was supplied at time of analysis.
Improper TLS certificate validation in Zoom Clients for Windows allows an attacker who already holds a man-in-the-middle position on the network path to have a forged or invalid certificate accepted by the client, exposing data in transit (CWE-295). Affected are Zoom Clients for Windows builds tracked by the vendor CPE cpe:2.3:a:zoom_communications:zoom_clients (wildcard versioning indicates the bulletin applies across the client line, with specifics in Zoom security bulletin ZSB-26021). No authentication (PR:N) or user interaction (UI:N) is required once the interception position is held, but high attack complexity (AC:H) reflects that the attacker must first compromise the network path - e.g., hostile Wi-Fi, ARP/DNS spoofing, or a compromised network device - so this is not exploitable by an arbitrary remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The reported CVSS base score of 7.4 (High) is driven by AV:N/PR:N/UI:N, and the assessed impact is high confidentiality loss with integrity impact not confirmed by our independent assessment.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Information disclosure in certain Zoom Clients' My Notes feature allows an on-path attacker who presents a fraudulent certificate to obtain feature-related data because the client fails to validate certificates properly. The vulnerability is remotely reachable without authentication or user interaction (AV:N/AC:H/PR:N/UI:N), but exploitability is constrained by the requirement to hold a man-in-the-middle position on the network path, and the independent assessment limits impact to confidentiality. No public exploit or confirmed active exploitation (CISA KEV) was identified, and no EPSS score was supplied at time of analysis.
Improper TLS certificate validation in Zoom Clients for Windows allows an attacker who already holds a man-in-the-middle position on the network path to have a forged or invalid certificate accepted by the client, exposing data in transit (CWE-295). Affected are Zoom Clients for Windows builds tracked by the vendor CPE cpe:2.3:a:zoom_communications:zoom_clients (wildcard versioning indicates the bulletin applies across the client line, with specifics in Zoom security bulletin ZSB-26021). No authentication (PR:N) or user interaction (UI:N) is required once the interception position is held, but high attack complexity (AC:H) reflects that the attacker must first compromise the network path - e.g., hostile Wi-Fi, ARP/DNS spoofing, or a compromised network device - so this is not exploitable by an arbitrary remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The reported CVSS base score of 7.4 (High) is driven by AV:N/PR:N/UI:N, and the assessed impact is high confidentiality loss with integrity impact not confirmed by our independent assessment.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.