Buffer overflow in Zoom Video Communications, Inc. products - CVE-2023-36532

Vulnerability identifier: #VU79367

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36532

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and crash the application.

Zoom Workplace Desktop App for Linux
Zoom Rooms Client for Windows
Zoom Rooms Client for macOS
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace App for Android

Install updates from vendor's website.

Zoom Workplace Desktop App for Linux - update to 5.14.5 2430
Zoom Rooms Client for Windows - update to 5.14.5 2778
Zoom Rooms Client for macOS - update to 5.14.5 2929
Zoom Workplace App for Android - update to 5.14.5 13340
Zoom Workplace Desktop App for Windows - update to 5.14.5 15287
Zoom Workplace Desktop App for macOS - update to 5.14.5 17687

• https://explore.zoom.us/en/trust/security/security-bulletin/

• Denial of service in Zoom Desktop Client and Zoom Rooms