Improper certificate validation in Zoom Client for Meetings for Windows
Priority MEDIUM 49CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context.
Why it matters now
EPSS 0.04011 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Zoom Client for Meetings for Windows | All versions of the Zoom Client for Meetings for Windows before version 5.3.0 | — | No fix listed | CNA |
- Zoom Client for Meetings for Windows Vendor— Affected All versions of the Zoom Client for Meetings for Windows before version 5.3.0 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:* | before 5.3.0 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:* Versions before 5.3.0 Vulnerable ·Zoom Video Communications, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-33907
- 2026-10-03 Alias added: GHSA-f38f-hqfr-4qj5
- 2026-10-23 EPSS moved to the 90th–95th percentile
References
More Zoom Video Communications, Inc. Meetings vulnerabilities
- TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
- TI-2022-11393 Improper URL parsing in Zoom Clients CVSS 3.1CRITICAL 9.6
- TI-2022-07034 Improperly constrained session cookies in Zoom Client for Meetings CVSS 3.1CRITICAL 9.1
- TI-2022-07035 Update package downgrade in Zoom Client for Meetings for Windows CVSS 3.1HIGH 8.8
- TI-2022-07033 Improper XML Parsing in Zoom Client for Meetings CVSS 3.1HIGH 8.1
- TI-2020-09545 airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the… CVSS 3.1HIGH 7.5
Sources
- CVE-2021-33907 · CVE Program
- CVE-2021-33907 · NVD
- FIRST EPSS
- GHSA-f38f-hqfr-4qj5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences