Zoom Communications
Monthly
Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Account takeover in Zoom's Windows client family - the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows - lets a remote, unauthenticated attacker seize control of a victim's account by sending crafted input over the network, per Zoom's security bulletin ZSB-26014. The flaw stems from improper input validation (CWE-20) and carries a vendor CVSS of 9.8, reflecting full confidentiality, integrity, and availability impact with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.
Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Local privilege escalation in Remote Control for Zoom Contact Center for Windows prior to version 7.0.0 allows an authenticated user with local access to elevate privileges due to insufficient verification of data authenticity. The flaw, reported by Zoom and tracked in bulletin ZSB-26009, carries a CVSS 3.1 base score of 7.8 (High) with no public exploit identified at time of analysis. Exploitation requires existing local authenticated access, which limits opportunistic abuse but makes this a strong post-compromise pivot on workstations running the Zoom Contact Center remote control component.
Local privilege escalation in Zoom Rooms for Windows versions prior to 7.0.0 allows an authenticated user to gain elevated privileges through an untrusted search path weakness in the installer. The flaw (CWE-426) carries a CVSS 7.8 (High) rating with complete confidentiality, integrity, and availability impact, though EPSS exploitation probability is very low (0.01%) and there is no public exploit identified at time of analysis. CISA SSVC indicates no observed exploitation but total technical impact, making this a credible insider-threat or post-compromise escalation vector rather than an internet-facing risk.
Local privilege escalation in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 allows an authenticated low-privileged user to elevate to higher privileges through external control of a file name or path during installation routines. The flaw was reported by Zoom and carries CVSS 7.8 with total technical impact, though no public exploit identified at time of analysis and EPSS sits at 0.01%. SSVC indicates exploitation status 'none' and the attack is not automatable, marking this as a patch-on-schedule rather than emergency item.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access to the device to read limited confidential data by exploiting a failed protection mechanism. The vulnerability is constrained by both physical proximity and high privilege requirements, yielding a CVSS score of 1.8 - among the lowest possible. No active exploitation has been identified, and Zoom has released a fix in version 7.0.0 per their security bulletin ZSB-26006.
Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Account takeover in Zoom's Windows client family - the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows - lets a remote, unauthenticated attacker seize control of a victim's account by sending crafted input over the network, per Zoom's security bulletin ZSB-26014. The flaw stems from improper input validation (CWE-20) and carries a vendor CVSS of 9.8, reflecting full confidentiality, integrity, and availability impact with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.
Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Local privilege escalation in Remote Control for Zoom Contact Center for Windows prior to version 7.0.0 allows an authenticated user with local access to elevate privileges due to insufficient verification of data authenticity. The flaw, reported by Zoom and tracked in bulletin ZSB-26009, carries a CVSS 3.1 base score of 7.8 (High) with no public exploit identified at time of analysis. Exploitation requires existing local authenticated access, which limits opportunistic abuse but makes this a strong post-compromise pivot on workstations running the Zoom Contact Center remote control component.
Local privilege escalation in Zoom Rooms for Windows versions prior to 7.0.0 allows an authenticated user to gain elevated privileges through an untrusted search path weakness in the installer. The flaw (CWE-426) carries a CVSS 7.8 (High) rating with complete confidentiality, integrity, and availability impact, though EPSS exploitation probability is very low (0.01%) and there is no public exploit identified at time of analysis. CISA SSVC indicates no observed exploitation but total technical impact, making this a credible insider-threat or post-compromise escalation vector rather than an internet-facing risk.
Local privilege escalation in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 allows an authenticated low-privileged user to elevate to higher privileges through external control of a file name or path during installation routines. The flaw was reported by Zoom and carries CVSS 7.8 with total technical impact, though no public exploit identified at time of analysis and EPSS sits at 0.01%. SSVC indicates exploitation status 'none' and the attack is not automatable, marking this as a patch-on-schedule rather than emergency item.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access to the device to read limited confidential data by exploiting a failed protection mechanism. The vulnerability is constrained by both physical proximity and high privilege requirements, yielding a CVSS score of 1.8 - among the lowest possible. No active exploitation has been identified, and Zoom has released a fix in version 7.0.0 per their security bulletin ZSB-26006.