CVE-2026-53411

HIGH

Zoom Workplace VDI Plugin for Windows - Improper Input Validation

Title source: cna

Description

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

References (1)

Core 1

Core References

https://www.zoom.com/en/trust/security-bulletin/zsb-26013

Scores

CVSS v3 7.8

EPSS 0.0014

EPSS Percentile 4.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-20

Status published

Products (1)

Zoom Communications/Zoom Workplace VDI Plugin < 6.6.14

Published Jul 16, 2026

Tracked Since Jul 17, 2026