Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client.
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
| Link | Tags |
|---|---|
| https://explore.zoom.us/en/trust/security/security-bulletin/ | vendor advisory |