Improper URL parsing in Zoom Clients
Priority MEDIUM 43CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.
Why it matters now
EPSS 0.00866 58th percentileScored 2026-11-07
Fix Fixed Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc): 5.11.0Zoom VDI Windows Meeting Clients (Zoom Video Communications Inc): 5.10.7
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) | before 5.11.0 | 5.11.0 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom VDI Windows Meeting Clients | before 5.10.7 | 5.10.7 | Patch available | CNA |
- Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) VendorZoom Video Communications, Inc. Affected before 5.11.0 Fixed in 5.11.0 Patch available CNA
- Zoom VDI Windows Meeting Clients VendorZoom Video Communications, Inc. Affected before 5.10.7 Fixed in 5.10.7 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* | before 5.10.7 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:* | before 5.11.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:* | before 5.11.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:* | before 5.11.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* | before 5.11.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* | before 5.11.0 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions before 5.10.7 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:* Versions before 5.11.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:* Versions before 5.11.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:* Versions before 5.11.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* Versions before 5.11.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* Versions before 5.11.0 Vulnerable ·Zoom Video Communications, Inc.
Remediation
- Fix · CNA Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) (Zoom Video Communications Inc) Fixed in 5.11.0
- Fix · CNA Zoom VDI Windows Meeting Clients (Zoom Video Communications Inc) Fixed in 5.10.7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-28755
- 2026-10-03 Alias added: GHSA-v5p6-gf48-89h4
References
More Zoom Video Communications, Inc. Virtual Desktop Infrastructure vulnerabilities
- TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
- TI-2023-20371 Injection in Zoom Desktop Client for Windows and Zoom VDI Client CVSS 3.1CRITICAL 9.8
- TI-2022-11393 Improper URL parsing in Zoom Clients CVSS 3.1CRITICAL 9.6
- TI-2023-23333 Untrusted search path in Zoom Desktop Client for Windows, Zoom VDI Client for Windows and… CVSS 3.1HIGH 8.8
- TI-2023-27110 Zoom Desktop Client for Windows - Improper Access Control CVSS 3.1HIGH 8.8
- TI-2023-16966 Cross-site scripting in Zoom for Windows CVSS 3.1HIGH 8.8
Sources
- CVE-2022-28755 · CVE Program
- CVE-2022-28755 · NVD
- FIRST EPSS
- GHSA-v5p6-gf48-89h4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences