The Zoom desktop and VDI clients and the Meeting SDK for Windows are vulnerable to an improper input validation flaw that could allow an unauthenticated attacker to conduct privilege escalation on the target system over the network.
Zoom is a popular cloud-based video conferencing service for corporate meetings, educational lessons, social interactions/gatherings, and more.
It offers screen sharing, meeting recording, custom backgrounds, in-meeting chat, and various productivity-focused features.
The newly disclosed flaw is tracked as CVE-2024-24691 and was discovered by Zoom’s offensive security team, receiving a CVSS v3.1 score of 9.6, rating it “Critical.”
For most people, Zoom should automatically prompts users to update to the latest version.
Zoom users should apply the security update as soon as possible to mitigate the likelihood of external actors elevating their privileges to a level that allows them to steal sensitive data, disrupt or eavesdrop on meetings, and install backdoors.
