Improper signature verification in Zoom for Windows Client
Priority LOW 39CWE-347Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00134 2nd percentileScored 2026-11-07
Fix Fixed Zoom for Windows Client (Zoom Video Communications, Inc.): 5.14.0Zoom Rooms Client for Windows (Zoom Video Communications, Inc.): 5.14.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom for Windows Client | before 5.14.0 | 5.14.0 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom Rooms Client for Windows | before 5.14.0 | 5.14.0 | Patch available | CNA |
| Zoom Video Communications, Inc. | Zoom VDI for Windows Meeting Clients | before 5.14.0 | 5.14.0 | Patch available | CNA |
- Zoom for Windows Client VendorZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA
- Zoom Rooms Client for Windows VendorZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA
- Zoom VDI for Windows Meeting Clients VendorZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* | before 5.14.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions before 5.14.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Zoom for Windows Client (Zoom Video Communications, Inc.) Fixed in 5.14.0
- Fix · CNA Zoom Rooms Client for Windows (Zoom Video Communications, Inc.) Fixed in 5.14.0
- Fix · CNA Zoom VDI for Windows Meeting Clients (Zoom Video Communications, Inc.) Fixed in 5.14.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-34120
- 2026-10-03 Alias added: GHSA-6j86-v54w-73w8
References
More Zoom Video Communications, Inc. Virtual Desktop Infrastructure vulnerabilities
- TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
- TI-2023-20371 Injection in Zoom Desktop Client for Windows and Zoom VDI Client CVSS 3.1CRITICAL 9.8
- TI-2022-11393 Improper URL parsing in Zoom Clients CVSS 3.1CRITICAL 9.6
- TI-2022-11385 Improper URL parsing in Zoom Clients CVSS 3.1CRITICAL 9.6
- TI-2023-23333 Untrusted search path in Zoom Desktop Client for Windows, Zoom VDI Client for Windows and… CVSS 3.1HIGH 8.8
- TI-2023-27110 Zoom Desktop Client for Windows - Improper Access Control CVSS 3.1HIGH 8.8
Sources
- CVE-2023-34120 · CVE Program
- CVE-2023-34120 · NVD
- FIRST EPSS
- GHSA-6j86-v54w-73w8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences