Zoom Video Communications vulnerabilities
We track 55 vulnerabilities in Zoom Video Communications products across 43 products. 55 are rated high or critical, and none are known to be exploited. The most recent was published on May 15, 2024.
Latest Zoom Video Communications vulnerabilities
- 7.8 High severity
Zoom Workplace VDI App for Windows: Improper Verification of Cryptographic Signature
Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.8 High severity
Zoom Desktop Client for Windows: Improper Verification of Cryptographic Signature
Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalation of privilege via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows, Zoom VDI…: Improper Handling of Unicode Encoding
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 7.8 High severity
Zoom Desktop Client for Windows, Zoom VDI…: Incorrect Privilege Assignment
Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.
- 8.8 High severity
Zoom Desktop Client for Windows, Zoom VDI…: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
- 7.8 High severity
Zoom Rooms for macOS: Improper Handling of Insufficient Permissions or Privileges
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.5 High severity
Zoom Rooms Client for Windows and Zoom VDI…: Memory Allocation with Excessive Size Value
Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disclosure of information via network access.
- 7.5 High severity
Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an…
Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of service via network access.
- 8.1 High severity
Zoom SDK's: Exposure of Resource to Wrong Sphere
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
- 9.8 Critical severity
Zoom Desktop Client for Windows and Zoom VDI…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 7.8 High severity
Zoom Desktop Client for Windows and Zoom Rooms…: Improper Privilege Management
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 8.8 High severity
Zoom Desktop Client for Windows: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
- 7.8 High severity
Zoom Desktop Client for Windows: Untrusted Search Path
Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Improper Validation of Integrity Check Value
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Exposure of Resource to Wrong Sphere
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Execution with Unnecessary Privileges
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 8.8 High severity
Zoom Desktop Client for Windows: Improper Neutralization of Special Elements used in an OS Command
Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.
- 8.8 High severity
Zoom for Windows: Improper Neutralization of Input During Web Page Generation
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
- 7.8 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher le
- 7.1 High severity
Zoom VDI Windows Meeting Client: External Control of File Name or Path
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
- 7.7 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Trust Boundary Violation
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the vi
- 7.8 High severity
Zoom Client for Meetings for IT Admin macOS…: Uncontrolled Search Path Element
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to
- 7.8 High severity
Zoom Client for Meetings for IT Admin Windows…: Time-of-check Time-of-use (TOCTOU) Race Condition
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges t
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Improper Restriction of Operations within the Bounds of a Memory Buffer
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Improper Restriction of Operations within the Bounds of a Memory Buffer
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
- 7.5 High severity
Zoom for Windows: Exposure of Sensitive Information to an Unauthorized Actor
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by
- 7.8 High severity
Zoom Rooms for Windows: Uncontrolled Search Path Element
Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Rooms for Windows: Time-of-check Time-of-use (TOCTOU) Race Condition
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.1 High severity
Zoom for Android: Improper Limitation of a Pathname to a Restricted Directory
Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
- 7.8 High severity
Zoom Rooms for macOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Improper Neutralization of Special Elements used in an OS Command
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Use of Hard-coded Credentials
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local lo
- 7.8 High severity
Zoom Rooms Installer for Windows: Uncontrolled Search Path Element
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Client for Meetings Installer for macOS…: Concurrent Execution using Shared Resource with Improper Synchronization
The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their pr
- 7.3 High severity
Zoom Client for Meetings for Windows (32-bit): Uncontrolled Search Path Element
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code