Buffer overflow in Zoom Video Communications, Inc. products - CVE-2024-27243

Vulnerability identifier: #VU105749

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-27243

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in some Zoom Workplace Apps and SDKs. A remote attacker can trick the victim into performing certain actions and crash the application.

Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Meeting SDK for macOS
Zoom Meeting SDK for iOS
Zoom Meeting SDK for Windows
Zoom Meeting SDK for Android
Zoom Meeting SDK for Linux
Virtual Desktop Infrastructure (VDI)

Install updates from vendor's website.

Zoom Workplace Desktop App for Windows - update to 5.17.5 31030
Zoom Workplace Desktop App for macOS - update to 5.17.5 29101
Zoom Workplace App for iOS - update to 5.17.5 13040
Zoom Workplace App for Android - update to 5.17.5 19058
Zoom Workplace Desktop App for Linux - update to 5.17.5 2543
Zoom Meeting SDK for macOS - update to 5.17.5
Zoom Meeting SDK for iOS - update to 5.17.5
Zoom Meeting SDK for Windows - update to 5.17.5
Zoom Meeting SDK for Android - update to 5.17.5
Virtual Desktop Infrastructure (VDI) - addressed in versions 5.15.17.24820, 5.16.15.24830, 5.17.5 24630
Zoom Meeting SDK for Linux - update to 5.17.5

• https://www.zoom.com/en/trust/security-bulletin/zsb-24014/

• Denial of service in Zoom Workplace Apps and SDKs