Insufficient control flow management in some Zoom clients may allow an authenticated user…
Priority LOW 30CWE-449Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00654 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zoom Video Communications, Inc. | Zoom Clients | see references | — | No fix listed | CNA |
- Zoom Clients VendorZoom Video Communications, Inc. Affected see references Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoom:meetings:*:*:*:*:*:iphone_os:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:meetings:*:*:*:*:*:linux:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* | before 5.14.13; 5.15.0 to before 5.15.11 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* | before 5.16.0 | Vulnerable | Zoom Video Communications, Inc. |
- cpe:2.3:a:zoom:meetings:*:*:*:*:*:iphone_os:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:meetings:*:*:*:*:*:linux:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:* Versions before 5.14.13; 5.15.0 to before 5.15.11 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* Versions before 5.16.0 Vulnerable ·Zoom Video Communications, Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-43588
- 2026-10-03 Alias added: GHSA-gg49-9gcv-q853
- 2026-10-14 EPSS moved to the 50th–90th percentile
References
More Zoom Video Communications, Inc. Meetings vulnerabilities
- TI-2021-13217 Improper certificate validation in Zoom Client for Meetings for Windows CVSS 3.1CRITICAL 9.8
- TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
- TI-2022-11393 Improper URL parsing in Zoom Clients CVSS 3.1CRITICAL 9.6
- TI-2022-07034 Improperly constrained session cookies in Zoom Client for Meetings CVSS 3.1CRITICAL 9.1
- TI-2022-07035 Update package downgrade in Zoom Client for Meetings for Windows CVSS 3.1HIGH 8.8
- TI-2022-07033 Improper XML Parsing in Zoom Client for Meetings CVSS 3.1HIGH 8.1
Sources
- CVE-2023-43588 · CVE Program
- CVE-2023-43588 · NVD
- FIRST EPSS
- GHSA-gg49-9gcv-q853 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences