Zoom
15 CVEs across 62 Zoom products. Browse Zoom vulnerabilities, severities, and proof-of-concept exploits.
Zoom products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-53412 | Critical | 9.8 | 2026-07-16 | Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user t… |
CVE-2026-53411 | High | 7.8 | 2026-07-16 | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authen… |
CVE-2026-53408 | High | 8.1 | 2026-06-12 | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticate… |
CVE-2026-53407 | High | 8.1 | 2026-06-12 | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7.0.4 for Android and before 7.0.3 for iOS may allow an unauthenticate… |
CVE-2026-53406 | High | 7.8 | 2026-06-12 | Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to en… |
CVE-2026-30906 | High | 7.8 | 2026-05-13 | Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via… |
CVE-2026-30905 | High | 7.8 | 2026-05-13 | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to con… |
CVE-2026-30904 | Low | 1.8 | 2026-05-13 | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of information via physical… |
CVE-2026-30903 | Critical | 9.6 | 2026-03-11 | External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation… |
CVE-2026-30902 | High | 7.8 | 2026-03-11 | Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2026-30901 | High | 7.0 | 2026-03-11 | Improper Input Validation in Zoom Rooms for Windows before 6.6.5 in Kiosk Mode may allow an authenticated user to conduct an escalation of privilege via local… |
CVE-2026-30900 | High | 7.8 | 2026-03-11 | Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privi… |
CVE-2025-67461 | Medium | 5.0 | 2025-12-10 | External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via l… |
CVE-2025-67460 | High | 7.8 | 2025-12-10 | Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privile… |
CVE-2025-62484 | High | 8.1 | 2025-11-13 | Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of… |
CVE-2025-64741 | High | 8.1 | 2025-11-13 | Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via… |
CVE-2025-64740 | High | 7.5 | 2025-11-13 | Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escal… |
CVE-2025-64739 | Medium | 4.3 | 2025-11-13 | External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2025-64738 | Medium | 5.0 | 2025-11-13 | External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information… |
CVE-2025-62483 | Medium | 5.3 | 2025-11-13 | Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of informatio… |
CVE-2025-62482 | Medium | 4.3 | 2025-11-13 | Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access. |
CVE-2025-30669 | Medium | 4.8 | 2025-11-13 | Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access. |
CVE-2025-30662 | Medium | 6.6 | 2025-11-13 | Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tr… |
CVE-2025-58133 | Medium | 5.3 | 2025-10-15 | Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network acce… |
CVE-2025-58132 | Medium | 4.1 | 2025-10-15 | Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-58135 | Medium | 5.3 | 2025-09-09 | Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network… |
CVE-2025-58134 | Medium | 4.3 | 2025-09-09 | Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access. |
CVE-2025-49461 | Medium | 4.3 | 2025-09-09 | Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-49460 | Medium | 4.3 | 2025-09-09 | Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2025-49458 | Medium | 6.5 | 2025-09-09 | Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-49457 | Critical | 9.6 | 2025-08-12 | Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access |
CVE-2025-49456 | Medium | 6.2 | 2025-08-12 | Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access. |
CVE-2025-49464 | Medium | 6.5 | 2025-07-10 | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access. |
CVE-2025-49463 | Medium | 6.5 | 2025-07-10 | Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of informat… |
CVE-2025-49462 | Low | 3.5 | 2025-07-10 | Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access. |
CVE-2025-46789 | Medium | 6.5 | 2025-07-10 | Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access. |
CVE-2025-46788 | High | 7.4 | 2025-07-10 | Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via netwo… |
CVE-2025-46786 | Medium | 4.3 | 2025-05-14 | Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access. |
CVE-2025-46785 | Medium | 6.5 | 2025-05-14 | Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30668 | Medium | 6.5 | 2025-05-14 | Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30667 | Medium | 6.5 | 2025-05-14 | NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30666 | Medium | 6.5 | 2025-05-14 | NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30665 | Medium | 6.5 | 2025-05-14 | NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30664 | Medium | 6.6 | 2025-05-14 | Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2025-30663 | High | 8.8 | 2025-05-14 | Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2025-30671 | Medium | 6.5 | 2025-04-08 | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30670 | Medium | 6.5 | 2025-04-08 | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-27443 | Low | 2.8 | 2025-04-08 | Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local acces… |
CVE-2025-27442 | Medium | 4.6 | 2025-04-08 | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |
CVE-2025-27441 | Medium | 4.6 | 2025-04-08 | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |
CVE-2025-27440 | High | 8.5 | 2025-03-11 | Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-27439 | High | 8.5 | 2025-03-11 | Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-0151 | High | 8.5 | 2025-03-11 | Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-0150 | High | 7.1 | 2025-03-11 | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network ac… |
CVE-2025-0149 | Medium | 6.5 | 2025-03-11 | Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. |
CVE-2024-27246 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27245 | Medium | 4.3 | 2025-02-25 | Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27239 | Medium | 4.3 | 2025-02-25 | Use after free in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-45426 | Medium | 4.9 | 2025-02-25 | Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45425 | Medium | 4.9 | 2025-02-25 | Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. |
CVE-2024-45424 | Medium | 5.3 | 2025-02-25 | Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2024-45421 | High | 8.5 | 2025-02-25 | Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2024-45418 | Medium | 5.4 | 2025-02-25 | Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via… |
CVE-2024-45417 | Medium | 6.0 | 2025-02-25 | Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of inf… |
CVE-2025-0147 | High | 8.8 | 2025-01-30 | Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2025-0146 | Low | 3.9 | 2025-01-30 | Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local acce… |
CVE-2025-0145 | Medium | 4.6 | 2025-01-30 | Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local ac… |
CVE-2025-0144 | Low | 3.1 | 2025-01-30 | Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access. |
CVE-2025-0143 | Medium | 4.3 | 2025-01-30 | Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access. |
CVE-2024-45422 | Medium | 6.5 | 2024-11-19 | Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2024-45420 | Medium | 4.3 | 2024-11-19 | Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-45419 | High | 8.1 | 2024-11-19 | Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access. |
CVE-2024-42441 | Medium | 6.2 | 2024-08-14 | Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1… |
CVE-2024-42440 | Medium | 6.2 | 2024-08-14 | Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1… |
CVE-2024-42439 | Medium | 6.5 | 2024-08-14 | Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to cond… |
CVE-2024-42438 | Medium | 6.5 | 2024-08-14 | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netw… |
CVE-2024-42437 | Medium | 6.5 | 2024-08-14 | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netw… |
CVE-2024-42436 | Medium | 6.5 | 2024-08-14 | Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via netw… |
CVE-2024-42435 | Medium | 4.9 | 2024-08-14 | Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information… |
CVE-2024-42434 | Medium | 4.9 | 2024-08-14 | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure… |
CVE-2024-39825 | High | 8.5 | 2024-08-14 | Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2024-39824 | Medium | 4.9 | 2024-08-14 | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure… |
CVE-2024-39823 | Medium | 4.9 | 2024-08-14 | Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure… |
CVE-2024-39822 | Medium | 6.5 | 2024-08-14 | Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an informatio… |
CVE-2024-39818 | High | 7.5 | 2024-08-14 | Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access. |
CVE-2024-39827 | Medium | 5.5 | 2024-07-15 | Improper input validation in the installer for Zoom Workplace Desktop App for Windows before version 6.0.10 may allow an authenticated user to conduct a denial… |
CVE-2024-39826 | Medium | 6.8 | 2024-07-15 | Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network acc… |
CVE-2024-39821 | Medium | 6.6 | 2024-07-15 | Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of servic… |
CVE-2024-39820 | Medium | 6.6 | 2024-07-15 | Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a d… |
CVE-2024-39819 | Medium | 6.7 | 2024-07-15 | Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local… |
CVE-2024-27241 | Medium | 5.3 | 2024-07-15 | Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27240 | High | 7.1 | 2024-07-15 | Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access. |
CVE-2024-27238 | High | 7.1 | 2024-07-15 | Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation… |
CVE-2024-27244 | Medium | 6.7 | 2024-05-15 | Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalatio… |
CVE-2024-27243 | Medium | 6.5 | 2024-05-15 | Buffer overflow in some Zoom Workplace Apps and SDK’s may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-27247 | Medium | 5.5 | 2024-04-09 | Improper privilege management in the installer for Zoom Desktop Client for macOS before version 5.17.10 may allow a privileged user to conduct an escalation of… |
CVE-2024-27242 | Medium | 4.1 | 2024-04-09 | Cross site scripting in Zoom Desktop Client for Linux before version 5.17.10 may allow an authenticated user to conduct a denial of service via network access. |
CVE-2024-24694 | Medium | 5.9 | 2024-04-09 | Improper privilege management in the installer for Zoom Desktop Client for Windows before version 5.17.10 may allow an authenticated user to conduct an escalat… |
CVE-2024-24693 | High | 7.2 | 2024-03-13 | Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service… |
CVE-2024-24692 | Medium | 5.3 | 2024-03-13 | Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via loca… |