Read the docs
TI-2021-13457 Aliases CVE-2021-34423GHSA-m7cq-vpfp-92jw

Buffer overflow in Zoom client and other products

Priority MEDIUM 48CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.

Why it matters now

EPSS 0.03268 88th percentileScored 2026-11-07
Fix Fixed Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc): 5.8.4Zoom Client for Meetings for Blackberry (for Android and iOS) (Zoom Video Communications Inc): 5.8.1+20 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Zoom Video Communications, Inc.Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)before 5.8.45.8.4Patch availableCNA
Zoom Video Communications, Inc.Zoom Client for Meetings for Blackberry (for Android and iOS)before 5.8.15.8.1Patch availableCNA
Zoom Video Communications, Inc.Zoom Client for Meetings for intune (for Android and iOS)before 5.8.45.8.4Patch availableCNA
Zoom Video Communications, Inc.Zoom Client for Meetings for Chrome OSbefore 5.0.15.0.1Patch availableCNA
Zoom Video Communications, Inc.Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows)before 5.8.35.8.3Patch availableCNA
Zoom Video Communications, Inc.Controllers for Zoom Rooms (for Android, iOS, and Windows)before 5.8.35.8.3Patch availableCNA
Zoom Video Communications, Inc.Zoom VDI Windows Meeting Clientbefore 5.8.45.8.4Patch availableCNA
Zoom Video Communications, Inc.Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64)before 5.8.4.211125.8.4.21112Patch availableCNA
Zoom Video Communications, Inc.Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS)before 5.8.4.211125.8.4.21112Patch availableCNA
Zoom Video Communications, Inc.Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS)before 5.8.4.211125.8.4.21112Patch availableCNA
Zoom Video Communications, Inc.Zoom Meeting SDK for Androidbefore 5.7.6.19225.7.6.1922Patch availableCNA
Zoom Video Communications, Inc.Zoom Meeting SDK for iOSbefore 5.7.6.10825.7.6.1082Patch availableCNA
Zoom Video Communications, Inc.Zoom Meeting SDK for macOSbefore 5.7.6.13405.7.6.1340Patch availableCNA
Zoom Video Communications, Inc.Zoom Meeting SDK for Windowsbefore 5.7.6.10815.7.6.1081Patch availableCNA
Zoom Video Communications, Inc.Zoom Video SDK (for Android, iOS, macOS, and Windows)before 1.1.21.1.2Patch availableCNA
Zoom Video Communications, Inc.Zoom On-Premise Meeting Connector Controllerbefore 4.8.12.202111154.8.12.20211115Patch availableCNA
Zoom Video Communications, Inc.Zoom On-Premise Meeting Connector MMRbefore 4.8.12.202111154.8.12.20211115Patch availableCNA
Zoom Video Communications, Inc.Zoom On-Premise Recording Connectorbefore 5.1.0.65.202111165.1.0.65.20211116Patch availableCNA
Zoom Video Communications, Inc.Zoom On-Premise Virtual Room Connectorbefore 4.4.7266.202111174.4.7266.20211117Patch availableCNA
Zoom Video Communications, Inc.Zoom On-Premise Virtual Room Connector Load Balancerbefore 2.5.5692.202111172.5.5692.20211117Patch availableCNA
Zoom Video Communications, Inc.Zoom Hybrid Zproxybefore 1.0.1058.202111161.0.1058.20211116Patch availableCNA
Zoom Video Communications, Inc.Zoom Hybrid MMRbefore 4.6.20211116.131_x86-644.6.20211116.131_x86-64Patch availableCNA
  • Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.8.4 Fixed in 5.8.4 Patch available CNA
  • Zoom Client for Meetings for Blackberry (for Android and iOS) VendorZoom Video Communications, Inc. Affected before 5.8.1 Fixed in 5.8.1 Patch available CNA
  • Zoom Client for Meetings for intune (for Android and iOS) VendorZoom Video Communications, Inc. Affected before 5.8.4 Fixed in 5.8.4 Patch available CNA
  • Zoom Client for Meetings for Chrome OS VendorZoom Video Communications, Inc. Affected before 5.0.1 Fixed in 5.0.1 Patch available CNA
  • Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.8.3 Fixed in 5.8.3 Patch available CNA
  • Controllers for Zoom Rooms (for Android, iOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.8.3 Fixed in 5.8.3 Patch available CNA
  • Zoom VDI Windows Meeting Client VendorZoom Video Communications, Inc. Affected before 5.8.4 Fixed in 5.8.4 Patch available CNA
  • Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) VendorZoom Video Communications, Inc. Affected before 5.8.4.21112 Fixed in 5.8.4.21112 Patch available CNA
  • Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) VendorZoom Video Communications, Inc. Affected before 5.8.4.21112 Fixed in 5.8.4.21112 Patch available CNA
  • Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) VendorZoom Video Communications, Inc. Affected before 5.8.4.21112 Fixed in 5.8.4.21112 Patch available CNA
  • Zoom Meeting SDK for Android VendorZoom Video Communications, Inc. Affected before 5.7.6.1922 Fixed in 5.7.6.1922 Patch available CNA
  • Zoom Meeting SDK for iOS VendorZoom Video Communications, Inc. Affected before 5.7.6.1082 Fixed in 5.7.6.1082 Patch available CNA
  • Zoom Meeting SDK for macOS VendorZoom Video Communications, Inc. Affected before 5.7.6.1340 Fixed in 5.7.6.1340 Patch available CNA
  • Zoom Meeting SDK for Windows VendorZoom Video Communications, Inc. Affected before 5.7.6.1081 Fixed in 5.7.6.1081 Patch available CNA
  • Zoom Video SDK (for Android, iOS, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 1.1.2 Fixed in 1.1.2 Patch available CNA
  • Zoom On-Premise Meeting Connector Controller VendorZoom Video Communications, Inc. Affected before 4.8.12.20211115 Fixed in 4.8.12.20211115 Patch available CNA
  • Zoom On-Premise Meeting Connector MMR VendorZoom Video Communications, Inc. Affected before 4.8.12.20211115 Fixed in 4.8.12.20211115 Patch available CNA
  • Zoom On-Premise Recording Connector VendorZoom Video Communications, Inc. Affected before 5.1.0.65.20211116 Fixed in 5.1.0.65.20211116 Patch available CNA
  • Zoom On-Premise Virtual Room Connector VendorZoom Video Communications, Inc. Affected before 4.4.7266.20211117 Fixed in 4.4.7266.20211117 Patch available CNA
  • Zoom On-Premise Virtual Room Connector Load Balancer VendorZoom Video Communications, Inc. Affected before 2.5.5692.20211117 Fixed in 2.5.5692.20211117 Patch available CNA
  • Zoom Hybrid Zproxy VendorZoom Video Communications, Inc. Affected before 1.0.1058.20211116 Fixed in 1.0.1058.20211116 Patch available CNA
  • Zoom Hybrid MMR VendorZoom Video Communications, Inc. Affected before 4.6.20211116.131_x86-64 Fixed in 4.6.20211116.131_x86-64 Patch available CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:*before 5.8.3VulnerableZoom Video Communications, Inc.
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*not specified by NVDRunning onGoogle
cpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:*before 5.8.4VulnerableZoom Video Communications, Inc.
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:zoom:meetings_for_blackberry:*:*:*:*:*:*:*:*before 5.8.1VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:meetings_for_intune:*:*:*:*:*:*:*:*before 5.8.4VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:meetings_for_chrome_os:*:*:*:*:*:*:*:*before 5.0.1VulnerableZoom Video Communications, Inc.
  • cpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:* Versions before 5.8.3 Vulnerable ·Zoom Video Communications, Inc.
  • cpe:2.3:o:google:android:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Google
  • cpe:2.3:a:zoom:meetings:*:*:*:*:*:*:*:* Versions before 5.8.4 Vulnerable ·Zoom Video Communications, Inc.
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:zoom:meetings_for_blackberry:*:*:*:*:*:*:*:* Versions before 5.8.1 Vulnerable ·Zoom Video Communications, Inc.
  • cpe:2.3:a:zoom:meetings_for_intune:*:*:*:*:*:*:*:* Versions before 5.8.4 Vulnerable ·Zoom Video Communications, Inc.
  • cpe:2.3:a:zoom:meetings_for_chrome_os:*:*:*:*:*:*:*:* Versions before 5.0.1 Vulnerable ·Zoom Video Communications, Inc.
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zoom:rooms_for_conference_rooms:*:*:*:*:*:*:*:*before 5.8.3VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:controllers_for_zoom_rooms:*:*:*:*:*:*:*:*before 5.8.3VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*before 5.8.4VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:android_meeting_sdk:*:*:*:*:*:*:*:*before 5.7.6.1922VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:iphone_os_meeting_sdk:*:*:*:*:*:*:*:*before 5.7.6.1082VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:macos_meeting_sdk:*:*:*:*:*:*:*:*before 5.7.6.1340VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:windows_meeting_sdk:*:*:*:*:*:*:*:*before 5.7.6.1081VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:android_video_sdk:*:*:*:*:*:*:*:*before 1.1.2VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:iphone_os_video_sdk:*:*:*:*:*:*:*:*before 1.1.2VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:macos_video_sdk:*:*:*:*:*:*:*:*before 1.1.2VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:windows_video_sdk:*:*:*:*:*:*:*:*before 1.1.2VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:hybrid_mmr:*:*:*:*:*:*:*:*before 4.6.20211116.131VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:hybrid_zproxy:*:*:*:*:*:*:*:*before 1.0.1058.20211116VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_controller:*:*:*:*:*:*:*:*before 4.8.12.20211115VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:*before 4.8.12.20211115VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom_on-premise_recording_connector:*:*:*:*:*:*:*:*before 5.1.0.65.20211116VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector:*:*:*:*:*:*:*:*before 4.4.7266.20211117VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom_on-premise_virtual_room_connector_load_balancer:*:*:*:*:*:*:*:*before 2.5.5692.20211117VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:vdi_azure_virtual_desktop:*:*:*:*:*:*:*:*before 5.8.4.21112VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:vdi_citrix:*:*:*:*:*:*:*:*before 5.8.4.21112VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:vdi_vmware:*:*:*:*:*:*:*:*before 5.8.4.21112VulnerableZoom Video Communications, Inc.
cpe:2.3:a:zoom:vdi_windows_meeting_client:*:*:*:*:*:*:*:*before 5.8.4VulnerableZoom Video Communications, Inc.

Remediation

  • Fix · CNA Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.8.4
  • Fix · CNA Zoom Client for Meetings for Blackberry (for Android and iOS) (Zoom Video Communications Inc) Fixed in 5.8.1
  • Fix · CNA Zoom Client for Meetings for intune (for Android and iOS) (Zoom Video Communications Inc) Fixed in 5.8.4
  • Fix · CNA Zoom Client for Meetings for Chrome OS (Zoom Video Communications Inc) Fixed in 5.0.1
  • Fix · CNA Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.8.3
  • Fix · CNA Controllers for Zoom Rooms (for Android, iOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.8.3
  • Fix · CNA Zoom VDI Windows Meeting Client (Zoom Video Communications Inc) Fixed in 5.8.4
  • Fix · CNA Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) (Zoom Video Communications Inc) Fixed in 5.8.4.21112
  • Fix · CNA Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) (Zoom Video Communications Inc) Fixed in 5.8.4.21112
  • Fix · CNA Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) (Zoom Video Communications Inc) Fixed in 5.8.4.21112
  • Fix · CNA Zoom Meeting SDK for Android (Zoom Video Communications Inc) Fixed in 5.7.6.1922
  • Fix · CNA Zoom Meeting SDK for iOS (Zoom Video Communications Inc) Fixed in 5.7.6.1082
  • Fix · CNA Zoom Meeting SDK for macOS (Zoom Video Communications Inc) Fixed in 5.7.6.1340
  • Fix · CNA Zoom Meeting SDK for Windows (Zoom Video Communications Inc) Fixed in 5.7.6.1081
  • Fix · CNA Zoom Video SDK (for Android, iOS, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 1.1.2
  • Fix · CNA Zoom On-Premise Meeting Connector Controller (Zoom Video Communications Inc) Fixed in 4.8.12.20211115
  • Fix · CNA Zoom On-Premise Meeting Connector MMR (Zoom Video Communications Inc) Fixed in 4.8.12.20211115
  • Fix · CNA Zoom On-Premise Recording Connector (Zoom Video Communications Inc) Fixed in 5.1.0.65.20211116
  • Fix · CNA Zoom On-Premise Virtual Room Connector (Zoom Video Communications Inc) Fixed in 4.4.7266.20211117
  • Fix · CNA Zoom On-Premise Virtual Room Connector Load Balancer (Zoom Video Communications Inc) Fixed in 2.5.5692.20211117
  • Fix · CNA Zoom Hybrid Zproxy (Zoom Video Communications Inc) Fixed in 1.0.1058.20211116
  • Fix · CNA Zoom Hybrid MMR (Zoom Video Communications Inc) Fixed in 4.6.20211116.131_x86-64

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Zoom Video Communications Controllers for Zoom Rooms (for Android, iOS, and Windows), Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) and 19 more products 1.0.1058.20211116, 1.1.2 and 14 more versions

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-13458 Process memory exposure in Zoom Client and other productsPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34423
  2. 2026-10-03 Alias added: GHSA-m7cq-vpfp-92jw

References

Advisory 2

  • TI-2021-13458 Process memory exposure in Zoom Client and other products CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences