CVE-2024-24691

Published: Feb 14, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Affected (6)

Products: Zoom: Meeting Software Development Kit, Rooms, Vdi Windows Meeting Clients, Zoom

Zoom

4 products

Meeting Software Development Kit

Rooms

Vdi Windows Meeting Clients

Zoom

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Zoom Meeting Software Development Kit	Before 5.16.5
Zoom Rooms	Before 5.17.0
Zoom Vdi Windows Meeting Clients	Before 5.14.14
Zoom Vdi Windows Meeting Clients	After 5.14.14 to 5.15.12
Zoom Vdi Windows Meeting Clients	After 5.15.12 to 5.16.10
Zoom Zoom	Before 5.16.5

Related CWEs

CWE-176

Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.

References (2)

https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/

Source: security@zoom.us

Vendor Advisory

https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.