Zoom Communications
Monthly
Information disclosure in certain Zoom Clients' My Notes feature allows an on-path attacker who presents a fraudulent certificate to obtain feature-related data because the client fails to validate certificates properly. The vulnerability is remotely reachable without authentication or user interaction (AV:N/AC:H/PR:N/UI:N), but exploitability is constrained by the requirement to hold a man-in-the-middle position on the network path, and the independent assessment limits impact to confidentiality. No public exploit or confirmed active exploitation (CISA KEV) was identified, and no EPSS score was supplied at time of analysis.
Improper TLS certificate validation in Zoom Clients for Windows allows an attacker who already holds a man-in-the-middle position on the network path to have a forged or invalid certificate accepted by the client, exposing data in transit (CWE-295). Affected are Zoom Clients for Windows builds tracked by the vendor CPE cpe:2.3:a:zoom_communications:zoom_clients (wildcard versioning indicates the bulletin applies across the client line, with specifics in Zoom security bulletin ZSB-26021). No authentication (PR:N) or user interaction (UI:N) is required once the interception position is held, but high attack complexity (AC:H) reflects that the attacker must first compromise the network path - e.g., hostile Wi-Fi, ARP/DNS spoofing, or a compromised network device - so this is not exploitable by an arbitrary remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The reported CVSS base score of 7.4 (High) is driven by AV:N/PR:N/UI:N, and the assessed impact is high confidentiality loss with integrity impact not confirmed by our independent assessment.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Account takeover in Zoom's Windows client family - the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows - lets a remote, unauthenticated attacker seize control of a victim's account by sending crafted input over the network, per Zoom's security bulletin ZSB-26014. The flaw stems from improper input validation (CWE-20) and carries a vendor CVSS of 9.8, reflecting full confidentiality, integrity, and availability impact with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.
Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Local privilege escalation in Remote Control for Zoom Contact Center for Windows prior to version 7.0.0 allows an authenticated user with local access to elevate privileges due to insufficient verification of data authenticity. The flaw, reported by Zoom and tracked in bulletin ZSB-26009, carries a CVSS 3.1 base score of 7.8 (High) with no public exploit identified at time of analysis. Exploitation requires existing local authenticated access, which limits opportunistic abuse but makes this a strong post-compromise pivot on workstations running the Zoom Contact Center remote control component.
Local privilege escalation in Zoom Rooms for Windows versions prior to 7.0.0 allows an authenticated user to gain elevated privileges through an untrusted search path weakness in the installer. The flaw (CWE-426) carries a CVSS 7.8 (High) rating with complete confidentiality, integrity, and availability impact, though EPSS exploitation probability is very low (0.01%) and there is no public exploit identified at time of analysis. CISA SSVC indicates no observed exploitation but total technical impact, making this a credible insider-threat or post-compromise escalation vector rather than an internet-facing risk.
Local privilege escalation in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 allows an authenticated low-privileged user to elevate to higher privileges through external control of a file name or path during installation routines. The flaw was reported by Zoom and carries CVSS 7.8 with total technical impact, though no public exploit identified at time of analysis and EPSS sits at 0.01%. SSVC indicates exploitation status 'none' and the attack is not automatable, marking this as a patch-on-schedule rather than emergency item.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access to the device to read limited confidential data by exploiting a failed protection mechanism. The vulnerability is constrained by both physical proximity and high privilege requirements, yielding a CVSS score of 1.8 - among the lowest possible. No active exploitation has been identified, and Zoom has released a fix in version 7.0.0 per their security bulletin ZSB-26006.
Information disclosure in certain Zoom Clients' My Notes feature allows an on-path attacker who presents a fraudulent certificate to obtain feature-related data because the client fails to validate certificates properly. The vulnerability is remotely reachable without authentication or user interaction (AV:N/AC:H/PR:N/UI:N), but exploitability is constrained by the requirement to hold a man-in-the-middle position on the network path, and the independent assessment limits impact to confidentiality. No public exploit or confirmed active exploitation (CISA KEV) was identified, and no EPSS score was supplied at time of analysis.
Improper TLS certificate validation in Zoom Clients for Windows allows an attacker who already holds a man-in-the-middle position on the network path to have a forged or invalid certificate accepted by the client, exposing data in transit (CWE-295). Affected are Zoom Clients for Windows builds tracked by the vendor CPE cpe:2.3:a:zoom_communications:zoom_clients (wildcard versioning indicates the bulletin applies across the client line, with specifics in Zoom security bulletin ZSB-26021). No authentication (PR:N) or user interaction (UI:N) is required once the interception position is held, but high attack complexity (AC:H) reflects that the attacker must first compromise the network path - e.g., hostile Wi-Fi, ARP/DNS spoofing, or a compromised network device - so this is not exploitable by an arbitrary remote attacker; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable). The reported CVSS base score of 7.4 (High) is driven by AV:N/PR:N/UI:N, and the assessed impact is high confidentiality loss with integrity impact not confirmed by our independent assessment.
Zoom Workplace clients with the Zoom Phone feature contain a network-reachable buffer overflow (CWE-120) that can lead to privilege escalation and full compromise of confidentiality, integrity, and availability on the targeted client. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H, base 8.0) requires user interaction and high attack complexity, and it indicates low privileges are needed even though the vendor description claims unauthenticated access-this authentication prerequisite is unverified. No public exploit identified at time of analysis.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Path traversal (CWE-23) in Zoom VDI Client and Plugins exposes authenticated local users to information disclosure and potential file integrity impact by allowing directory escape via crafted path input. Affected are all tracked versions under cpe:2.3:a:zoom_communications:zoom_vdi. No public exploit code or CISA KEV listing exists at time of analysis, but the High confidentiality and integrity impact ratings warrant prompt patching in VDI environments where insider or post-compromise scenarios are relevant threats.
Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.
Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.
Account takeover in Zoom's Windows client family - the Zoom Desktop Client, Zoom VDI Client, and Zoom Meeting SDK for Windows - lets a remote, unauthenticated attacker seize control of a victim's account by sending crafted input over the network, per Zoom's security bulletin ZSB-26014. The flaw stems from improper input validation (CWE-20) and carries a vendor CVSS of 9.8, reflecting full confidentiality, integrity, and availability impact with no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch.
Privilege escalation in Zoom Workplace VDI Plugin for Windows (all versions prior to 6.6.14) is achievable by an authenticated local user exploiting a TOCTOU race condition during the product's installation or uninstallation process. The attack targets the narrow window between the installer's security check and its subsequent resource use, allowing a local attacker to substitute a controlled file or symlink and have it processed under elevated installer privileges. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.14% at the 4th percentile signals very low real-world exploitation probability, though SSVC rates the technical impact as total if the race is won.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Local privilege escalation in Remote Control for Zoom Contact Center for Windows prior to version 7.0.0 allows an authenticated user with local access to elevate privileges due to insufficient verification of data authenticity. The flaw, reported by Zoom and tracked in bulletin ZSB-26009, carries a CVSS 3.1 base score of 7.8 (High) with no public exploit identified at time of analysis. Exploitation requires existing local authenticated access, which limits opportunistic abuse but makes this a strong post-compromise pivot on workstations running the Zoom Contact Center remote control component.
Local privilege escalation in Zoom Rooms for Windows versions prior to 7.0.0 allows an authenticated user to gain elevated privileges through an untrusted search path weakness in the installer. The flaw (CWE-426) carries a CVSS 7.8 (High) rating with complete confidentiality, integrity, and availability impact, though EPSS exploitation probability is very low (0.01%) and there is no public exploit identified at time of analysis. CISA SSVC indicates no observed exploitation but total technical impact, making this a credible insider-threat or post-compromise escalation vector rather than an internet-facing risk.
Local privilege escalation in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 allows an authenticated low-privileged user to elevate to higher privileges through external control of a file name or path during installation routines. The flaw was reported by Zoom and carries CVSS 7.8 with total technical impact, though no public exploit identified at time of analysis and EPSS sits at 0.01%. SSVC indicates exploitation status 'none' and the attack is not automatable, marking this as a patch-on-schedule rather than emergency item.
Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.
Information disclosure in Zoom Workplace for iOS before version 7.0.0 allows an authenticated user with physical access to the device to read limited confidential data by exploiting a failed protection mechanism. The vulnerability is constrained by both physical proximity and high privilege requirements, yielding a CVSS score of 1.8 - among the lowest possible. No active exploitation has been identified, and Zoom has released a fix in version 7.0.0 per their security bulletin ZSB-26006.