Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-27245: Zoom Workplace Apps and SDKs Denial of Service Risk

CVE-2024-27245 · published 1 year ago

Summary

Some versions of Zoom's Workplace Apps and Software Development Kits (SDKs) have a bug that could allow a logged-in user to crash the application or make it unavailable for others. This could happen if a malicious user sends a large amount of data to the affected application. To stay secure, update to the latest version of the software as soon as possible.

What to do

Update zoom meeting_software_development_kit to version 5.17.11 or later.
Update zoom rooms to version 6.0.0 or later.
Update zoom workplace to version 5.17.11 or later.
Update zoom workplace_desktop to version 5.17.11 or later.

Affected software

Vendor	Product	Affected versions
zoom	meeting_software_development_kit	< 5.17.11 `cpe:2.3:a:zoom:meeting_software_development_kit::::::android::*`
zoom	rooms	< 6.0.0 `cpe:2.3:a:zoom:rooms::::::ipados::*`
zoom	workplace	< 5.17.11 `cpe:2.3:a:zoom:workplace::::::android::*`
zoom	workplace_desktop	< 5.17.11 `cpe:2.3:a:zoom:workplace_desktop::::::linux::*`
zoom	workplace_virtual_desktop_infrastructure	< 5.15.17 >= 5.16.0, < 5.16.15 >= 5.16.16, < 5.17.11 `cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure::::::windows::*`

Original advisory text

Buffer overflow in some Zoom Workplace Apps and SDKs may allow an authenticated user to conduct a denial of service via network access.

References

https://www.zoom.com/en/trust/security-bulletin/zsb-24016/ Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

Timeline

Published25 Feb 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-27245 · NVD

Track software like this

Free during beta