TI-2026-71763 Aliases CVE-2026-53420 GHSA-v64v-vg73-53qc

Buffer overflow in Zoom Phone feature of Zoom Workplace Clients

LOW 37CWE-120Published 2026-10-13 · Updated 2026-10-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A buffer overflow in a Zoom Phone feature of Zoom Workplace Clients lets an unauthenticated attacker on the network gain elevated privileges. The flaw is a buffer copy without a size check (CWE-120). Exploitation requires user interaction and a high-complexity condition, and the impact on confidentiality, integrity and availability is high.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00315 24th percentileScored 2026-11-07

Fix Fixed Zoom Workplace (Zoom Communications): 7.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom Workplace	before 7.2.0	7.2.0	Patch available	CNA

Zoom Workplace VendorZoom Video Communications, Inc. Affected before 7.2.0 Fixed in 7.2.0 Patch available CNA

Remediation

Zoom Workplace versions before 7.2.0 are affected, and the fix is available in 7.2.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Fix · CNA Zoom Workplace (Zoom Communications) Fixed in 7.2.0

Timeline

2026-10-13 Threatist record created from CVE-2026-53420
2026-10-13 Alias added: GHSA-v64v-vg73-53qc
2026-10-14 CISA SSVC decision points changed

References

Other 1

https://www.zoom.com/en/trust/security-bulletin/zsb-26020

TI-2026-18340 Zoom Node Deployments - Command Injection CVSS 3.1CRITICAL 9.9
TI-2017-11048 The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not… CVSS 3.1HIGH 8.8
TI-2017-11047 Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux… CVSS 3.1HIGH 8.8
TI-2020-04976 Path traversal in Zoom CVSS 3.1CRITICAL 9.8
TI-2026-38498 Zoom Workplace VDI Plugin for Windows - Improper Input Validation CVSS 3.1CRITICAL 9.8
TI-2021-13217 Improper certificate validation in Zoom Client for Meetings for Windows CVSS 3.1CRITICAL 9.8

See all 252 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences