Zoom vulnerabilities
We track 83 vulnerabilities in Zoom products across 19 products. 83 are rated high or critical, and none are known to be exploited. The most recent was published on July 16, 2026.
Latest Zoom vulnerabilities
- 7.8 High severity
Zoom Desktop Client for Windows and Zoom Rooms…: Improper Privilege Management
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows: Improper Neutralization of Script-Related HTML Tags in a Web Page
Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 8.8 High severity
Zoom Desktop Client for Windows: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.
- 7.8 High severity
Zoom Desktop Client for Windows: Untrusted Search Path
Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 9.8 Critical severity
Zoom Desktop Client for Windows: Improper Limitation of a Pathname to a Restricted Directory
Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Improper Validation of Integrity Check Value
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Untrusted Search Path
Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Exposure of Resource to Wrong Sphere
Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
- 7.8 High severity
Zoom Rooms for Windows: Execution with Unnecessary Privileges
Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
- 8.8 High severity
Zoom Desktop Client for Windows: Improper Neutralization of Special Elements used in an OS Command
Improper input validation in the Zoom Desktop Client for Windows before version 5.15.0 may allow an unauthorized user to enable an escalation of privilege via network access.
- 8.8 High severity
Zoom for Windows: Improper Neutralization of Input During Web Page Generation
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.
- 7.8 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher le
- 7.1 High severity
Zoom VDI Windows Meeting Client: External Control of File Name or Path
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
- 7.7 High severity
Zoom for Windows Client: Improper Verification of Cryptographic Signature
Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A malicious user may potentially downgrade Zoom Client components to previous versions.
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Trust Boundary Violation
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the vi
- 7.8 High severity
Zoom Client for Meetings for IT Admin macOS…: Uncontrolled Search Path Element
Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to
- 7.8 High severity
Zoom Client for Meetings for IT Admin Windows…: Time-of-check Time-of-use (TOCTOU) Race Condition
Zoom Client for IT Admin Windows installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges t
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Improper Restriction of Operations within the Bounds of a Memory Buffer
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
- 7.5 High severity
Zoom (for Android, iOS, Linux, macOS, and…: Improper Restriction of Operations within the Bounds of a Memory Buffer
Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.
- 7.5 High severity
Zoom for Windows: Exposure of Sensitive Information to an Unauthorized Actor
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by
- 7.8 High severity
Zoom Rooms for Windows: Uncontrolled Search Path Element
Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Rooms for Windows: Time-of-check Time-of-use (TOCTOU) Race Condition
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.1 High severity
Zoom for Android: Improper Limitation of a Pathname to a Restricted Directory
Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to the Zoom application data directory.
- 7.8 High severity
Zoom Rooms for macOS: Time-of-check Time-of-use (TOCTOU) Race Condition
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Improper Neutralization of Special Elements used in an OS Command
Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.
- 7.8 High severity
Zoom Rooms for macOS: Use of Hard-coded Credentials
Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local lo
- 7.8 High severity
Zoom Rooms Installer for Windows: Uncontrolled Search Path Element
The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Client for Meetings Installer for macOS…: Concurrent Execution using Shared Resource with Improper Synchronization
The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability during the install process to escalate their pr
- 7.3 High severity
Zoom Client for Meetings for Windows (32-bit): Uncontrolled Search Path Element
Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code
- 9.6 Critical severity
Zoom Client for Meetings (for Android, iOS…: URL Redirection to Untrusted Site
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network
- 7.8 High severity
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior…
Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a
- 7.8 High severity
Zoom Client for Meetings for MacOS: Insufficient Verification of Data Authenticity
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to r
- 7.8 High severity
Zoom Room for Conference Room for Windows: Improper Verification of Cryptographic Signature
Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulnerability. A local low-privileged malicious user could exploit this vulnerability to escalate their privileges to the SYSTEM user.
- 7.8 High severity
Zoom Client for Meetings for MacOS: Improper Verification of Cryptographic Signature
The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their priv
- 7.8 High severity
Zoom Client for Meetings for MacOS: Improper Verification of Cryptographic Signature
The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to r
- 9.8 Critical severity
Zoom On-Premise Meeting Connector Zone…: Out-of-bounds Write
Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.202
- 7.8 High severity
Zoom Client for Meetings: Uncontrolled Search Path Element
The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for
- 7.5 High severity
Zoom Client for Meetings for Android: Improper Certificate Validation
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users clie
- 8.8 High severity
Zoom Client for Meetings for Windows: Download of Code Without Integrity Check
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated at