TI-2023-09026 Aliases CVE-2023-22882 GHSA-rp8w-6f7v-487w

Denial of Service in Zoom Clients

LOW 35CWE-119Published 2023-03-16 · Updated 2025-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Zoom clients before version 5.13.5 contain a STUN parsing vulnerability. A malicious actor could send specially crafted UDP traffic to a victim Zoom client to remotely cause the client to crash, causing a denial of service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01142 66th percentileScored 2026-11-07

Fix Fixed Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 (Zoom Video Communications Inc): 5.13.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5	before 5.13.5	5.13.5	Patch available	CNA

Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 VendorZoom Video Communications, Inc. Affected before 5.13.5 Fixed in 5.13.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zoom:zoom::::::::	before 5.13.5	Vulnerable	Zoom Video Communications, Inc.

cpe:2.3:a:zoom:zoom:*:*:*:*:*:*:*:* Versions before 5.13.5 Vulnerable ·Zoom Video Communications, Inc.

Remediation

Fix · CNA Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 (Zoom Video Communications Inc) Fixed in 5.13.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2023-03-16
Zoom (for Android, iOS, Linux, macOS, and Windows) clients before version 5.13.5 5.13.5
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-09025 Denial of Service in Zoom ClientsPriority LOW 35
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2023-22882
2026-10-03 Alias added: GHSA-rp8w-6f7v-487w

References

Advisory 1

https://explore.zoom.us/en/trust/security/security-bulletin/

TI-2017-11048 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not… CVSS 3.1HIGH 8.8
TI-2017-11047 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux… CVSS 3.1HIGH 8.8
TI-2020-04976 Path traversal in Zoom CVSS 3.1CRITICAL 9.8
TI-2018-11203 Authentication bypass by spoofing in Zoom CVSS 3.0CRITICAL 9.8
TI-2024-16222 Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for… CVSS 3.1CRITICAL 9.8
TI-2023-20371 Injection in Zoom Desktop Client for Windows and Zoom VDI Client CVSS 3.1CRITICAL 9.8

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences