Zoom through 5.5.4 sometimes allows attackers to read private information on a…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:*:*:* | up to 5.5.4 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:*:*:* Versions up to 5.5.4 Vulnerable ·Zoom Video Communications, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28133
- 2026-10-03 Alias added: GHSA-qj56-qx26-7qr8
References
Advisory 7
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt
- https://zoom.us/trust/security/security-bulletin
- https://www.youtube.com/watch?v=SonmmgQlLzg
- https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133
- 20210319 [SYSS-2020-044]: Zoom - Exposure of Resource to Wrong Sphere (CWE-668) (CVE-2021-28133)
- https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html
- http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.html
More Zoom Video Communications, Inc. Zoom vulnerabilities
- TI-2017-11048 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not… CVSS 3.1HIGH 8.8
- TI-2017-11047 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux… CVSS 3.1HIGH 8.8
- TI-2020-04976 Path traversal in Zoom CVSS 3.1CRITICAL 9.8
- TI-2018-11203 Authentication bypass by spoofing in Zoom CVSS 3.0CRITICAL 9.8
- TI-2024-16222 Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for… CVSS 3.1CRITICAL 9.8
- TI-2023-20371 Injection in Zoom Desktop Client for Windows and Zoom VDI Client CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-28133 · CVE Program
- CVE-2021-28133 · NVD
- FIRST EPSS
- GHSA-qj56-qx26-7qr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences