Security News > 2024 > February > Zoom patches critical privilege elevation flaw in Windows apps
The Zoom desktop and VDI clients and the Meeting SDK for Windows are vulnerable to an improper input validation flaw that could allow an unauthenticated attacker to conduct privilege escalation on the target system over the network.
Zoom is a popular cloud-based video conferencing service for corporate meetings, educational lessons, social interactions/gatherings, and more.
It offers screen sharing, meeting recording, custom backgrounds, in-meeting chat, and various productivity-focused features.
The newly disclosed flaw is tracked as CVE-2024-24691 and was discovered by Zoom's offensive security team, receiving a CVSS v3.1 score of 9.6, rating it "Critical."
For most people, Zoom should automatically prompts users to update to the latest version.
Zoom users should apply the security update as soon as possible to mitigate the likelihood of external actors elevating their privileges to a level that allows them to steal sensitive data, disrupt or eavesdrop on meetings, and install backdoors.
News URL
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-02-14 | CVE-2024-24691 | Unspecified vulnerability in Zoom products Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access. | 9.8 |