CVE-2024-24691: critical vulnerability in Zoom Desktop Client for Windows, Zoom VDI…
Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The Zoom Desktop Client for Windows fails to properly check user inputs, allowing someone on the network to gain higher privileges without needing to log in first. This is a serious flaw because it can let attackers take control of the application or the system.
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client, and Meeting SDK for Windows enables unauthenticated privilege escalation via network vector. The vulnerability stems from insufficient sanitization of network-supplied inputs, allowing an attacker with network access to bypass authentication controls and elevate their privileges within the affected application.
In the same product, most dangerous first.