Security News > 2024 > February > Zoom patches critical privilege elevation flaw in Windows apps
The Zoom desktop and VDI clients and the Meeting SDK for Windows are vulnerable to an improper input validation flaw that could allow an unauthenticated attacker to conduct privilege escalation on the target system over the network.
Zoom is a popular cloud-based video conferencing service for corporate meetings, educational lessons, social interactions/gatherings, and more.
It offers screen sharing, meeting recording, custom backgrounds, in-meeting chat, and various productivity-focused features.
The newly disclosed flaw is tracked as CVE-2024-24691 and was discovered by Zoom's offensive security team, receiving a CVSS v3.1 score of 9.6, rating it "Critical."
For most people, Zoom should automatically prompts users to update to the latest version.
Zoom users should apply the security update as soon as possible to mitigate the likelihood of external actors elevating their privileges to a level that allows them to steal sensitive data, disrupt or eavesdrop on meetings, and install backdoors.
News URL
Related news
- March 2024 Patch Tuesday: Microsoft fixes critical bugs in Windows Hyper-V (source)
- Critical Rust flaw enables Windows command injection attacks (source)
- Critical 'BatBadBut' Rust Vulnerability Exposes Windows Systems to Attacks (source)
- Rust rustles up fix for 10/10 critical command injection bug on Windows in std lib (source)