Time-of-check Time-of-use (TOCTOU) Race Condition in Zoom Video Communications, Inc. products - CVE-2026-53410
Published: July 14, 2026
Vulnerability identifier: #VU137492
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-53410
CWE-ID: CWE-367
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Zoom Video Communications, Inc.
Affected software:
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Virtual Desktop Infrastructure (VDI)
Remote Control for Zoom Contact Center for Windows
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Virtual Desktop Infrastructure (VDI)
Remote Control for Zoom Contact Center for Windows
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a time-of-check to time-of-use race condition in the installation and uninstallation process when handling installation or uninstallation operations. A local user can trigger the race condition during installation or uninstallation to escalate privileges.
How to mitigate CVE-2026-53410
Install security update from vendor's website.