TI-2022-07028 Aliases CVE-2022-22779 GHSA-xg7w-9w3p-gqx3

Retained exploded messages in Keybase clients for macOS and Windows

LOW 19CWE-212Published 2022-02-09 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.

Why it matters now

EPSS 0.00801 56th percentileScored 2026-11-07

Fix Fixed Keybase Client for macOS (Zoom Video Communications Inc): 5.9.0Keybase Client for Windows (Zoom Video Communications Inc): 5.9.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Keybase Client for macOS	before 5.9.0	5.9.0	Patch available	CNA
Zoom Video Communications, Inc.	Keybase Client for Windows	before 5.9.0	5.9.0	Patch available	CNA

Keybase Client for macOS VendorZoom Video Communications, Inc. Affected before 5.9.0 Fixed in 5.9.0 Patch available CNA
Keybase Client for Windows VendorZoom Video Communications, Inc. Affected before 5.9.0 Fixed in 5.9.0 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:keybase:keybase::::::::	before 5.9.0	Vulnerable	Keybase
cpe:2.3:o:apple:macos:-:::::::*	not specified by NVD	Running on	Apple
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:keybase:keybase:*:*:*:*:*:*:*:* Versions before 5.9.0 Vulnerable ·Keybase
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Keybase Client for macOS (Zoom Video Communications Inc) Fixed in 5.9.0
Fix · CNA Keybase Client for Windows (Zoom Video Communications Inc) Fixed in 5.9.0

Timeline

2026-10-02 Threatist record created from CVE-2022-22779
2026-10-03 Alias added: GHSA-xg7w-9w3p-gqx3

References

Advisory 1

https://explore.zoom.us/en/trust/security/security-bulletin

TI-2026-18340 Zoom Node Deployments - Command Injection CVSS 3.1CRITICAL 9.9
TI-2017-11048 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not… CVSS 3.1HIGH 8.8
TI-2017-11047 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux… CVSS 3.1HIGH 8.8
TI-2020-04976 Path traversal in Zoom CVSS 3.1CRITICAL 9.8
TI-2026-38498 Zoom Workplace VDI Plugin for Windows - Improper Input Validation CVSS 3.1CRITICAL 9.8
TI-2021-13217 Improper certificate validation in Zoom Client for Meetings for Windows CVSS 3.1CRITICAL 9.8

See all 252 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences