CVE-2021-33907

CRITICAL

Zoom Meetings < 5.3.0 - Remote Code Execution via Improper Certificate Validation

Title source: llm
STIX 2.1

Description

The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .msi files when performing an update of the client. This could lead to remote code execution in an elevated privileged context.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0325
EPSS Percentile 87.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-295
Status published
Products (1)
zoom/meetings < 5.3.0
Published Sep 27, 2021
Tracked Since Feb 18, 2026