Rooms vulnerabilities
39 known vulnerabilities in Rooms from Zoom. 39 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.0 High severity
Zoom Clients: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.
- 7.8 High severity
Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an…
Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms: Untrusted Search Path
Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Workplace: Improper Privilege Management
Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.8 High severity
Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an…
Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms: Protection Mechanism Failure
Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via local access.
- 7.5 High severity
Zoom Clients: External Control of File Name or Path
External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.
- 7.5 High severity
Zoom Clients: Improper Removal of Sensitive Information Before Storage or Transfer
Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.
- 7.5 High severity
Zoom Rooms: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
- 7.5 High severity
Zoom Workplace Clients: Uncontrolled Resource Consumption
Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.
- 7.0 High severity
Zoom Workplace Apps: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
- 7.5 High severity
Zoom Apps: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
- 8.8 High severity
Zoom Apps for macOS: Improper Link Resolution Before File Access
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
- 7.8 High severity
Zoom Workplace Apps for Windows: Untrusted Search Path
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
- 8.5 High severity
Zoom Workplace Apps and Rooms Clients: Out-of-bounds Write
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
- 7.3 High severity
Zoom Workplace Apps and SDK for Windows: Download of Code Without Integrity Check
Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- 7.8 High severity
Improper input validation in the installer for some Zoom Apps for Windows may allow an…
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows, Zoom VDI…: Improper Handling of Unicode Encoding
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
- 7.8 High severity
Zoom Rooms for macOS: Improper Handling of Insufficient Permissions or Privileges
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
- 8.1 High severity
Zoom SDK's: Exposure of Resource to Wrong Sphere
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
- 7.8 High severity
Zoom Desktop Client for Windows and Zoom Rooms…: Improper Privilege Management
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Improper Validation of Integrity Check Value
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Exposure of Resource to Wrong Sphere
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Execution with Unnecessary Privileges
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 8.8 High severity
Zoom for Windows: Improper Neutralization of Input During Web Page Generation
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Trust Boundary Violation
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the vi
- 7.5 High severity
Zoom for Windows: Exposure of Sensitive Information to an Unauthorized Actor
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by
- 7.8 High severity
Zoom Rooms for Windows: Uncontrolled Search Path Element
Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Rooms for Windows: Time-of-check Time-of-use (TOCTOU) Race Condition
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Rooms for macOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Improper Neutralization of Special Elements used in an OS Command
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Use of Hard-coded Credentials
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local lo
- 7.8 High severity
Zoom Rooms Installer for Windows: Uncontrolled Search Path Element
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.3 High severity
Zoom Client for Meetings for Windows (32-bit): Uncontrolled Search Path Element
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code
- 7.8 High severity
Zoom Room for Conference Room for Windows: Improper Verification of Cryptographic Signature
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Client for Meetings: Uncontrolled Search Path Element
The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for
- 8.8 High severity
Zoom Client for Meetings for Windows: Download of Code Without Integrity Check
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated at