Zoom Meeting Software Development Kit

Zoom Workplace Apps Windows: Authenticated DoS via NULL Pointer Deref
CVE-2025-30666 - May 14, 2025

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

Zoom Workplace App Windows Null Deref Allows Authenticated DoS
CVE-2025-30665 - May 14, 2025

NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

Insecure Default Variable Init in Zoom Workplace Apps (Win)
CVE-2025-27443 5.5 - Medium - April 08, 2025

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.

Zoom Workplace Apps Windows NPE DoS via Network Access
CVE-2025-30670 - April 08, 2025

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

CVE-2025-30671: Zoom Workplace Windows App DoS via NPE
CVE-2025-30671 - April 08, 2025

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

Zoom Workplace Apps iOS <6.3.0 Authenticated User DDoS via Network
CVE-2025-0150 6.5 - Medium - March 11, 2025

Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access.

Zoom Workplace App: Unprivileged DOS via Unverified Data
CVE-2025-0149 7.5 - High - March 11, 2025

Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.

Zoom Workplace App Privilege Escalation: Info Disclosure via Network
CVE-2024-45425 6.5 - Medium - February 25, 2025

Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.

Zoom Workplace App Ownership Flaw Enables Info Disclosure
CVE-2024-45426 6.5 - Medium - February 25, 2025

Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.

Uncontrolled Res Consumption in Zoom App Installer (<6.1.5) on macOS
CVE-2024-45417 5.5 - Medium - February 25, 2025

Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.

Zoom Workplace Apps: Unauth Data Disclosure via Business Logic Flaw
CVE-2024-45424 7.5 - High - February 25, 2025

Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.

Zoom macOS App Pre-6.1.5 Symlink Following in Installer Causing Priv Escalation
CVE-2024-45418 8.8 - High - February 25, 2025

Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.

Zoom Apps Buffer Overflow Escalation via Authenticated Network Access
CVE-2024-45421 8.8 - High - February 25, 2025

Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.

Zoom Workplace App (Linux) v<6.2.10 - EoP via Net Type Confusion
CVE-2025-0147 9.8 - Critical - January 30, 2025

Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access.

Zoom Workplace App macOS <6.2.10 Symlink Following in Installer Local DOS
CVE-2025-0146 5 - Medium - January 30, 2025

Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.

OOB Write in Zoom Workplace App <=6.2.5 (Linux) - DoS
CVE-2025-0143 6.5 - Medium - January 30, 2025

Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access.

Zoom Apps Information Disclosure Vulnerability
CVE-2024-45419 7.5 - High - November 19, 2024

Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.

Zoom Apps Uncontrolled Resource Consumption Denial of Service Vulnerability
CVE-2024-45420 6.5 - Medium - November 19, 2024

Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.

Zoom Apps: Improper Input Validation Leading to Denial of Service
CVE-2024-45422 7.5 - High - November 19, 2024

Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.

Zoom Workplace Apps/SDKs/Rooms: Missing Auth Enables Info Disclosure
CVE-2024-39824 4.9 - Medium - August 14, 2024

Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

AuthZ

Zoom Desktop Apps <6.1.5 LPE via Installer
CVE-2024-42441 6.2 - Medium - August 14, 2024

Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.

Incorrect Privilege Assignment

Zoom WO Desktop App macOS 6.1.5 Improper Priv Escal via Installer
CVE-2024-42440 6.7 - Medium - August 14, 2024

Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.

Zoom macOS Installer Untrusted Search Path (6.0) Privileged Escalation
CVE-2024-42439 6.5 - Medium - August 14, 2024

Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.

Untrusted Path

Zoom Workplace Apps/SDK Buffer Overflow Enables Authenticated DoS
CVE-2024-42438 6.5 - Medium - August 14, 2024

Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.

Memory Corruption

Zoom Workplace/Rooms Buffer Overflow: Authenticated DoS via Network
CVE-2024-42437 6.5 - Medium - August 14, 2024

Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.

Memory Corruption

Zoom Workplace Buffer Overflow Allows Authenticated DoS
CVE-2024-42436 6.5 - Medium - August 14, 2024

Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.

Memory Corruption

Zoom Info Disclosure via Network (CVE-2024-42435)
CVE-2024-42435 4.9 - Medium - August 14, 2024

Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

Zoom Workplace: Authenticated Data Disclosure in Rooms Apps/SDKs
CVE-2024-39822 6.5 - Medium - August 14, 2024

Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.

Zoom Workplace Apps/SDKs/Rooms Clients: Missing Auth Allows Info Disclosure
CVE-2024-39823 4.9 - Medium - August 14, 2024

Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

AuthZ

Zoom Workplace Apps/SDKs Missing Auth Enabling Info Disclosure
CVE-2024-42434 4.9 - Medium - August 14, 2024

Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.

AuthZ

Zoom Workplace App Race Condition: Authenticated Info Disclosure (CVE-202439826)
CVE-2024-39826 6.8 - Medium - July 15, 2024

Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.

TOCTTOU

Zoom Workplace Desktop Priv Esc via Installer Integrity Check
CVE-2024-39819 6.7 - Medium - July 15, 2024

Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.

Download of Code Without Integrity Check

Zoom Apps Windows privilege escalation via installer race condition before 6.0.0
CVE-2024-27238 6.3 - Medium - July 15, 2024

Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.

Zoom Client & SDK Improper Input Validation EoP CVE-2024-24691
CVE-2024-24691 9.8 - Critical - February 14, 2024

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Zoom 32-bit Win Client Untrusted Search Path Priv Escalation
CVE-2024-24697 7.8 - High - February 14, 2024

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.

Untrusted Path

Zoom Client DoS via Improper Input Validation
CVE-2024-24690 6.5 - Medium - February 14, 2024

Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.

Improper Validation of Specified Quantity in Input

Zoom Desktop & SDK Auth Info Disclosure via Improper Validation
CVE-2024-24695 6.5 - Medium - February 14, 2024

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.

Zoom Client Info Disclosure via Auth Input Validation (CVE-2024-24696)
CVE-2024-24696 6.5 - Medium - February 14, 2024

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.

Zoom Client Improper Auth Allows Privileged Local Info Disclosure
CVE-2024-24698 4.4 - Medium - February 14, 2024

Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.

Zoom Desktop & SDK Local Priv Esc CVE-2023-49647 (pre-5.16.10)
CVE-2023-49647 7.8 - High - January 12, 2024

Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.

Zoom Mobile App & SDKs v<5.16.0: Privileged User Info Leak
CVE-2023-43583 4.9 - Medium - December 13, 2023

Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.

Zoom iOS Mobile App SDK Improper Access Control before 5.16.5
CVE-2023-43585 6.5 - Medium - December 13, 2023

Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.

Zoom Client <=5.16.5 Improper Auth leads to DoS via Network
CVE-2023-49646 6.5 - Medium - December 13, 2023

Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via network access.

authentification

Zoom Desktop Client Path Trv Auth Escalation via Net Access
CVE-2023-43586 8.8 - High - December 13, 2023

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.

Directory traversal

Zoom Client: Improper Auth Permits Authenticated DoS via Network Access
CVE-2023-39215 6.5 - Medium - September 12, 2023

Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.

authentification

Zoom Client SDK Windows <5.15.0: Cleartext Sensitive Data Storage (Local Disclosure)
CVE-2023-39210 5.5 - Medium - August 08, 2023

Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.

Cleartext Storage of Sensitive Information

Zoom Client SDK v<5.15.5 Info Disclosure & DoS via Network (CVE-2023-39214)
CVE-2023-39214 8.1 - High - August 08, 2023

Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.

Exposure of Resource to Wrong Sphere

Uncontrolled Resource Consumption in Zoom SDKs <=5.14.6 Enables Network DoS
CVE-2023-36533 7.5 - High - August 08, 2023

Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of service via network access.

Zoom SDK <5.14.10 Improper Input Validation Enables Unauth DoS
CVE-2023-39217 7.5 - High - August 08, 2023

Improper input validation in Zoom SDKs before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.