Zoom Rooms
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Zoom Rooms.
By the Year
In 2025 there have been 14 vulnerabilities in Zoom Rooms with an average score of 6.7 out of ten. Last year, in 2024 Rooms had 26 security vulnerabilities published. Right now, Rooms is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 0.33.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 14 | 6.69 |
| 2024 | 26 | 6.36 |
| 2023 | 27 | 7.44 |
| 2022 | 6 | 7.13 |
| 2021 | 2 | 7.80 |
It may take a day or so for new Rooms vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Zoom Rooms Security Vulnerabilities
Zoom Rooms Client Auth Bypass <6.5.1: Info Disclosure via Network
CVE-2025-58133
5.3 - Medium
- October 15, 2025
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
Authentication Bypass Using an Alternate Path or Channel
Zoom Workplace App Windows Null Deref Allows Authenticated DoS
CVE-2025-30665
- May 14, 2025
NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Zoom Workplace Apps Windows: Authenticated DoS via NULL Pointer Deref
CVE-2025-30666
- May 14, 2025
NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Insecure Default Variable Init in Zoom Workplace Apps (Win)
CVE-2025-27443
5.5 - Medium
- April 08, 2025
Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.
Zoom Workplace Apps Windows NPE DoS via Network Access
CVE-2025-30670
- April 08, 2025
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
CVE-2025-30671: Zoom Workplace Windows App DoS via NPE
CVE-2025-30671
- April 08, 2025
Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.
Zoom Workplace App: Unprivileged DOS via Unverified Data
CVE-2025-0149
7.5 - High
- March 11, 2025
Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access.
Zoom Workplace App Privilege Escalation: Info Disclosure via Network
CVE-2024-45425
6.5 - Medium
- February 25, 2025
Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Zoom macOS App Pre-6.1.5 Symlink Following in Installer Causing Priv Escalation
CVE-2024-45418
8.8 - High
- February 25, 2025
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
Uncontrolled Res Consumption in Zoom App Installer (<6.1.5) on macOS
CVE-2024-45417
5.5 - Medium
- February 25, 2025
Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.
Zoom Workplace App Ownership Flaw Enables Info Disclosure
CVE-2024-45426
6.5 - Medium
- February 25, 2025
Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Zoom Workplace Apps: Unauth Data Disclosure via Business Logic Flaw
CVE-2024-45424
7.5 - High
- February 25, 2025
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom Apps Buffer Overflow Escalation via Authenticated Network Access
CVE-2024-45421
8.8 - High
- February 25, 2025
Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.
Zoom Workplace App macOS <6.2.10 Symlink Following in Installer Local DOS
CVE-2025-0146
5 - Medium
- January 30, 2025
Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local access.
Zoom Apps: Improper Input Validation Leading to Denial of Service
CVE-2024-45422
7.5 - High
- November 19, 2024
Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.
Zoom Apps Uncontrolled Resource Consumption Denial of Service Vulnerability
CVE-2024-45420
6.5 - Medium
- November 19, 2024
Uncontrolled resource consumption in some Zoom Apps before version 6.2.0 may allow an authenticated user to conduct a denial of service via network access.
Zoom Apps Information Disclosure Vulnerability
CVE-2024-45419
7.5 - High
- November 19, 2024
Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Zoom WO Desktop App macOS 6.1.5 Improper Priv Escal via Installer
CVE-2024-42440
6.7 - Medium
- August 14, 2024
Improper privilege management in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
Zoom Workplace Apps/SDK Buffer Overflow Enables Authenticated DoS
CVE-2024-42438
6.5 - Medium
- August 14, 2024
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Memory Corruption
Zoom Workplace/Rooms Buffer Overflow: Authenticated DoS via Network
CVE-2024-42437
6.5 - Medium
- August 14, 2024
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Memory Corruption
Zoom Workplace Buffer Overflow Allows Authenticated DoS
CVE-2024-42436
6.5 - Medium
- August 14, 2024
Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Memory Corruption
Zoom Info Disclosure via Network (CVE-2024-42435)
CVE-2024-42435
4.9 - Medium
- August 14, 2024
Sensitive information disclosure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
Zoom Workplace Apps/SDKs Missing Auth Enabling Info Disclosure
CVE-2024-42434
4.9 - Medium
- August 14, 2024
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
AuthZ
Zoom Workplace Apps Client buffer overflow allows privileged escalation via net
CVE-2024-39825
8.5 - High
- August 14, 2024
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.
Memory Corruption
Zoom Workplace Apps/SDKs/Rooms: Missing Auth Enables Info Disclosure
CVE-2024-39824
4.9 - Medium
- August 14, 2024
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
AuthZ
Zoom Workplace Apps/SDKs/Rooms Clients: Missing Auth Allows Info Disclosure
CVE-2024-39823
4.9 - Medium
- August 14, 2024
Missing authorization in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow a privileged user to conduct an information disclosure via network access.
AuthZ
Zoom Workplace: Authenticated Data Disclosure in Rooms Apps/SDKs
CVE-2024-39822
6.5 - Medium
- August 14, 2024
Sensitive information exposure in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct an information disclosure via network access.
Zoom Workplace SDK Authenticated info disclosure via network
CVE-2024-39818
6.5 - Medium
- August 14, 2024
Protection mechanism failure for some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct information disclosure via network access.
Insufficiently Protected Credentials
Zoom Desktop Apps <6.1.5 LPE via Installer
CVE-2024-42441
6.2 - Medium
- August 14, 2024
Incorrect privilege assignment in the installer for Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS and Zoom Rooms Client for macOS before 6.1.5 may allow a privileged user to conduct an escalation of privilege via local access.
Incorrect Privilege Assignment
Zoom Apps Windows privilege escalation via installer race condition before 6.0.0
CVE-2024-27238
6.3 - Medium
- July 15, 2024
Race condition in the installer for some Zoom Apps and SDKs for Windows before version 6.0.0 may allow an authenticated user to conduct a privilege escalation via local access.
Zoom Apps Windows Installer PrivEsc via Input Validation
CVE-2024-27240
7.8 - High
- July 15, 2024
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a privilege escalation via local access.
Zoom Workplace Desktop Priv Esc via Installer Integrity Check
CVE-2024-39819
6.7 - Medium
- July 15, 2024
Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct a privilege escalation via local access.
Download of Code Without Integrity Check
Zoom Workplace & Rooms App Installer Race Condition Enables Local DoS
CVE-2024-39821
4.4 - Medium
- July 15, 2024
Race condition in the installer for Zoom Workplace App for Windows and Zoom Rooms App for Windows may allow an authenticated user to conduct a denial of service via local access.
Zoom Rooms Client Windows <5.17.5 Race-Condition DOS via Installer
CVE-2024-24692
4.7 - Medium
- March 13, 2024
Race condition in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
TOCTTOU
Improper ACL in Zoom Rooms Client installer <5.17.5 allows local DoS
CVE-2024-24693
5.5 - Medium
- March 13, 2024
Improper access control in the installer for Zoom Rooms Client for Windows before version 5.17.5 may allow an authenticated user to conduct a denial of service via local access.
Zoom Client DoS via Improper Input Validation
CVE-2024-24690
6.5 - Medium
- February 14, 2024
Improper input validation in some Zoom clients may allow an authenticated user to conduct a denial of service via network access.
Improper Validation of Specified Quantity in Input
Zoom Client & SDK Improper Input Validation EoP CVE-2024-24691
CVE-2024-24691
9.8 - Critical
- February 14, 2024
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
Zoom 32-bit Win Client Untrusted Search Path Priv Escalation
CVE-2024-24697
7.8 - High
- February 14, 2024
Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.
Untrusted Path
Zoom Client Improper Auth Allows Privileged Local Info Disclosure
CVE-2024-24698
4.4 - Medium
- February 14, 2024
Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
Zoom Authenticated Info Disclosure via Network Access Business Logic Error
CVE-2024-24699
6.5 - Medium
- February 14, 2024
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may
CVE-2023-43591
7.8 - High
- November 15, 2023
Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
Link following in Zoom Rooms for macOS before version 5.16.0 may
CVE-2023-43590
7.8 - High
- November 15, 2023
Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access.
insecure temporary file
Improper authorization in some Zoom clients may
CVE-2023-43582
8.8 - High
- November 15, 2023
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.
authentification
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may
CVE-2023-39202
5.5 - Medium
- November 14, 2023
Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
Untrusted Path
Cryptographic issues with In-Meeting Chat for some Zoom clients may
CVE-2023-39199
6.5 - Medium
- November 14, 2023
Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access.
Buffer overflow in some Zoom clients may
CVE-2023-39204
7.5 - High
- November 14, 2023
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Classic Buffer Overflow
Buffer overflow in some Zoom clients may
CVE-2023-39206
7.5 - High
- November 14, 2023
Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.
Classic Buffer Overflow
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may
CVE-2023-39214
8.1 - High
- August 08, 2023
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via network access.
Exposure of Resource to Wrong Sphere
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may
CVE-2023-39211
7.8 - High
- August 08, 2023
Improper privilege management in Zoom Desktop Client for Windows and Zoom Rooms for Windows before 5.15.5 may allow an authenticated user to enable an information disclosure via local access.
Improper Privilege Management
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may
CVE-2023-39212
5.5 - Medium
- August 08, 2023
Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.
Untrusted Path
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Zoom Rooms or by Zoom? Click the Watch button to subscribe.
