Select a language
A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service could allow a local Windows user to escalate privileges to those of the NT AUTHORITY/SYSTEM user.
The vulnerability is due to insufficient signature checks of dynamically loaded DLLs when loading a signed executable. An attacker could exploit this vulnerability by injecting a malicious DLL into a signed Zoom executable and using it to launch processes with elevated permissions.
Zoom addressed this issue in the 5.0.4 client release. Users can help keep themselves secure by applying current updates or downloading the latest Zoom software with all current security updates from https://zoom.us/download.
Connor Scott of Context Information Security
| Revision | Date | Description |
|---|---|---|
| 1.0 | 08/14/2020 | Initial Publication |