Local Privilege Escalation in Auto Updater for macOS Zoom products [Updated 2022-09-13]

  • ZSB-22018
  • CVE-2022-28756
  • High
  • 8.8
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 and Zoom Rooms for Conference Room for macOS before version 5.11.6 contains a vulnerability in the auto update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root.

Users can help keep themselves secure by applying current updates or downloading the latest Zoom software with all current security updates from https://zoom.us/download.

*Changes - 2022-09-13 - Updated title, description and added Zoom Rooms to the “Affected Products” section.

  • Zoom Client for Meetings for macOS (Standard and for IT Admin) starting version 5.7.3 and before version 5.11.5
  • Zoom Rooms for Conference Room for macOS before version 5.11.6

Reported by Patrick Wardle of Objective-See

Revision Date Description
1.1 09/13/2022

Updated title, description and added Zoom Rooms to the “Affected Products” section.
1.0 08/13/2022

Initial Publication