Buffer overflow in Zoom Video Communications, Inc. products - CVE-2024-39825

Vulnerability identifier: #VU95867

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39825

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Zoom Rooms Client for Windows
Zoom Rooms Client for macOS
Virtual Desktop Infrastructure (VDI)

Install updates from vendor's website.

Zoom Workplace App for iOS - update to 6.0.0
Zoom Workplace Desktop App for Windows - update to 6.0.0 37205
Zoom Workplace Desktop App for macOS - update to 6.0.0 33147
Virtual Desktop Infrastructure (VDI) - update to 5.17.13
Zoom Workplace App for Android - update to 6.0.0
Zoom Workplace Desktop App for Linux - update to 6.0.0 4563
Zoom Rooms Client for Windows - update to 6.0.0
Zoom Rooms Client for macOS - update to 6.0.0 6108

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24022/

• Remote code execution in Zoom Workplace Apps and Rooms clients