#VU105761 Buffer overflow in Zoom Video Communications, Inc. products - CVE-2024-45421

Vulnerability identifier: #VU105761

Vulnerability risk: High

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2024-45421

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Workplace Desktop App for Windows
Client/Desktop applications / Office applications
Zoom Workplace Desktop App for macOS
Client/Desktop applications / Office applications
Zoom Workplace Desktop App for Linux
Client/Desktop applications / Office applications
Zoom Rooms Client for Windows
Client/Desktop applications / Office applications
Zoom Rooms Client for macOS
Client/Desktop applications / Office applications
Zoom Rooms Controller for Windows
Client/Desktop applications / Office applications
Zoom Rooms Controller for macOS
Client/Desktop applications / Office applications
Zoom Rooms Controller for Linux
Client/Desktop applications / Office applications
Zoom Workplace App for iOS
Mobile applications / Apps for mobile phones
Zoom Workplace App for Android
Mobile applications / Apps for mobile phones
Zoom Rooms Client for iPad
Mobile applications / Apps for mobile phones
Zoom Rooms Controller for Android
Mobile applications / Apps for mobile phones
Virtual Desktop Infrastructure (VDI)
Server applications / Conferencing, Collaboration and VoIP solutions
Zoom Video SDK for Windows
Universal components / Libraries / Software for developers
Zoom Video SDK for macOS
Universal components / Libraries / Software for developers
Zoom Video SDK for iOS
Universal components / Libraries / Software for developers
Zoom Video SDK for Android
Universal components / Libraries / Software for developers
Zoom Video SDK for Linux
Universal components / Libraries / Software for developers
Zoom Meeting SDK for Windows
Universal components / Libraries / Software for developers
Zoom Meeting SDK for macOS
Universal components / Libraries / Software for developers
Zoom Meeting SDK for iOS
Universal components / Libraries / Software for developers
Zoom Meeting SDK for Android
Universal components / Libraries / Software for developers
Zoom Meeting SDK for Linux
Universal components / Libraries / Software for developers

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trick the victim into executing certain actions with the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zoom Workplace Desktop App for Windows: 0.9.10042.0911 - 6.1.12 46889

Zoom Workplace Desktop App for macOS: 4.6.9 19273.0402 - 6.1.11 39163

Zoom Workplace App for iOS: 4.6.10 20012.0407 - 6.1.11 17695

Zoom Workplace App for Android: 4.6.11 20553.0413 - 6.1.11 23988

Zoom Workplace Desktop App for Linux: 5.1.418436.0628 - 6.1.11 1545

Virtual Desktop Infrastructure (VDI): 6.0.10 - 6.0.12.25240, 6.1.0 - 6.1.10.25260

Zoom Rooms Client for Windows: 4.6.5 18374.0407 - 6.1.11

Zoom Rooms Client for macOS: 4.6.5 2040.0406 - 6.1.5 7039

Zoom Rooms Client for iPad: 6.0.0 - 6.1.0

Zoom Rooms Controller for Windows: 6.1.0

Zoom Rooms Controller for macOS: 6.1.0

Zoom Rooms Controller for Android: 6.1.0

Zoom Rooms Controller for Linux: 6.0.0 - 6.1.0

Zoom Video SDK for Windows: 1.2.0 - 5.16.5

Zoom Video SDK for macOS: 1.2.0 - 2.1.5

Zoom Video SDK for iOS: 1.2.0 - 2.1.5

Zoom Video SDK for Android: 1.2.0 - 2.1.5

Zoom Video SDK for Linux: 1.6.2 - 2.1.5

Zoom Meeting SDK for Windows: 5.9.0 - 6.1.10

Zoom Meeting SDK for macOS: 5.9.0 - 6.1.10

Zoom Meeting SDK for iOS: 5.9.0 - 6.1.10

Zoom Meeting SDK for Android: 5.9.0 - 6.1.10

Zoom Meeting SDK for Linux: 5.15.5 - 6.1.10

---

External links
https://www.zoom.com/en/trust/security-bulletin/zsb-24043/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.