Buffer overflow in Zoom Video Communications, Inc. products - CVE-2024-42436

Vulnerability identifier: #VU95826

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-42436

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error. A remote attacker can crash the application.

Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Virtual Desktop Infrastructure (VDI)

Install updates from vendor's website.

Zoom Workplace App for iOS - update to 6.1.0 16182
Zoom Workplace Desktop App for Windows - update to 6.1.0 41135
Zoom Workplace Desktop App for macOS - update to 6.1.0 35886
Virtual Desktop Infrastructure (VDI) - addressed in versions 5.17.14, 6.0.11
Zoom Workplace App for Android - update to 6.1.0 22482
Zoom Workplace Desktop App for Linux - update to 6.1.0 198

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24031/

• Multiple DoS vulnerabilities in Zoom Workplace Apps