Zoom Security Updates – 14 August 2024

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, conduct an information disclosure via network access, or gain elevated privileges to the affected system by sending a specially crafted request.

Sample of the addressed vulnerabilities:

1. Zoom Workplace Apps and Rooms Clients – Buffer Overflow Vulnerability (CVE-2024-39825):

• CVSS: 8.5
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: None
• Consequences: Privilege Escalation

2. Zoom Workplace Apps and SDKs – Protection Mechanism Failure Vulnerability (CVE-2024-39818):

• CVSS: 7.5
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Information Disclosure

Sample of affected products:

• Zoom Workplace Desktop App and Zoom Workplace VDI Client.
• Zoom Meeting SDK.
• Zoom Rooms Clients and Zoom Rooms Controller.
• Zoom Workplace App.