Zoom Workplace Desktop vulnerabilities

CVE-2026-30903 [CRITICAL] CWE-73 CVE-2026-30903: External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

CVE-2024-45421 [HIGH] CWE-122 CVE-2024-45421: Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privil Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2025-27440 [HIGH] CWE-124 CVE-2025-27440: Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation o Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2025-27439 [HIGH] CWE-124 CVE-2025-27439: Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalatio Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2025-0147 [CRITICAL] CWE-843 CVE-2025-0147: Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to con Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access.

CVE-2025-46788 [CRITICAL] CWE-295 CVE-2025-46788: Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unaut Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.

CVE-2025-49457 [HIGH] CWE-426 CVE-2025-49457: Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to condu Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

CVE-2024-39825 [HIGH] CWE-122 CVE-2024-39825: Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to con Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2024-45418 [HIGH] CWE-61 CVE-2024-45418: Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an au Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2025-0151 [HIGH] CWE-416 CVE-2025-0151: Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access.

CVE-2025-64739 [HIGH] CWE-73 CVE-2025-64739: External control of file name or path in certain Zoom Clients may allow an unauthenticated user to c External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

CVE-2025-58132 [MEDIUM] CWE-77 CVE-2025-58132: Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disc Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access.

CVE-2024-45419 [HIGH] CWE-252 CVE-2024-45419: Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosur Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via network access.

CVE-2024-45424 [HIGH] CWE-840 CVE-2024-45424: Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disc Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.

CVE-2025-62483 [HIGH] CWE-212 CVE-2025-62483: Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

CVE-2025-49460 [HIGH] CWE-400 CVE-2025-49460: Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated use Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.

CVE-2026-30902 [HIGH] CWE-269 CVE-2026-30902: Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to Improper Privilege Management in certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2024-45422 [HIGH] CWE-20 CVE-2024-45422: Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user t Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial of service via network access.

CVE-2026-30900 [HIGH] CWE-754 CVE-2026-30900: Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may al Improper Check of minimum version in update functionality of certain Zoom Clients for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

CVE-2024-27241 [HIGH] CWE-20 CVE-2024-27241: Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a de Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.