CVE-2023-22880

MEDIUM

Zoom Rooms < 5.13.5 - Information Disclosure via Microsoft Edge WebView2 Spellcheck

Title source: llm
STIX 2.1

Description

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

References (1)

Core 1

Scores

CVSS v3 6.8
EPSS 0.0046
EPSS Percentile 64.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (3)
zoom/rooms < 5.13.3
zoom/virtual_desktop_infrastructure < 5.13.1
zoom/zoom < 5.13.3
Published Mar 16, 2023
Tracked Since Feb 18, 2026