TI-2023-16966 Aliases CVE-2023-34121 GHSA-3r5h-mjx6-6cjh

Cross-site scripting in Zoom for Windows

MEDIUM 40CWE-79Published 2023-06-13 · Updated 2025-01-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via network access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00952 61st percentileScored 2026-11-07

Fix Fixed Zoom for Windows (Zoom Video Communications, Inc.): 5.14.0Zoom Rooms Client for Windows (Zoom Video Communications, Inc.): 5.14.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom for Windows	before 5.14.0	5.14.0	Patch available	CNA
Zoom Video Communications, Inc.	Zoom Rooms Client for Windows	before 5.14.0	5.14.0	Patch available	CNA
ZoomZoom Video Communications, Inc.	Zoom VDI for Windows Meeting Clients	before 5.14.0	5.14.0	Patch available	CNA

Zoom for Windows VendorZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA
Zoom Rooms Client for Windows VendorZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA
Zoom VDI for Windows Meeting Clients VendorZoomZoom Video Communications, Inc. Affected before 5.14.0 Fixed in 5.14.0 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:zoom:rooms::::::windows::*	before 5.14.0	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom::::::windows::*	before 5.14.0	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::	before 5.14.0	Vulnerable	Zoom Video Communications, Inc.
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:* Versions before 5.14.0 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* Versions before 5.14.0 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions before 5.14.0 Vulnerable ·Zoom Video Communications, Inc.
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Zoom for Windows (Zoom Video Communications, Inc.) Fixed in 5.14.0
Fix · CNA Zoom Rooms Client for Windows (Zoom Video Communications, Inc.) Fixed in 5.14.0
Fix · CNA Zoom VDI for Windows Meeting Clients (ZoomZoom Video Communications, Inc.) Fixed in 5.14.0

Timeline

2026-10-02 Threatist record created from CVE-2023-34121
2026-10-03 Alias added: GHSA-3r5h-mjx6-6cjh

References

Advisory 1

https://explore.zoom.us/en/trust/security/security-bulletin/

TI-2024-16222 Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for… CVSS 3.1CRITICAL 9.8
TI-2025-31505 Zoom Clients for Windows - Untrusted Search Path CVSS 3.1CRITICAL 9.6
TI-2022-07035 Update package downgrade in Zoom Client for Meetings for Windows CVSS 3.1HIGH 8.8
TI-2024-30470 Zoom Apps - Buffer Overflow CVSS 3.1HIGH 8.8
TI-2022-17145 Local Privilege Escalation in Zoom Rooms for Windows Installers CVSS 3.1HIGH 8.8
TI-2025-20275 Zoom Apps - Heap-based Buffer Overflow CVSS 3.1HIGH 8.8

See all 108 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences