CVE-2021-33907

2021-09-2713:55:30

Zoom

www.cve.org

zoom

windows

remote code execution

certificate validation

AI Score

9.8

Confidence

High

EPSS

0.004

Percentile

74.9%

JSON

The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context.

CNA Affected

[
  {
    "product": "Zoom Client for Meetings for Windows",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions of the Zoom Client for Meetings for Windows before version 5.3.0"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/