CVE-2026-53412
An improper input validation flaw in the Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows could let an unauthenticated attacker take over a user's account simply by sending malicious network traffic. The vulnerability is rated critical with a CVSS score of 9.8, reflecting high impact on confidentiality, integrity, and availability. No public exploit or known active exploitation is reported in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows.
Real-world impact
An attacker could hijack accounts, leading to unauthorized access to meetings, data, and further network moves.
Why this severity
CVSS 9.8 (Critical) because the flaw is network‑reachable, requires no privileges or user interaction, and can fully compromise confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources