CVE-2021-34423

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A buffer overflow vulnerability was discovered in Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom Client for Meetings for Blackberry (for Android and iOS) before version 5.8.1, Zoom Client for Meetings for intune (for Android and iOS) before version 5.8.4, Zoom Client for Meetings for Chrome OS before version 5.0.1, Zoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows) before version 5.8.3, Controllers for Zoom Rooms (for Android, iOS, and Windows) before version 5.8.3, Zoom VDI Windows Meeting Client before version 5.8.4, Zoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64) before version 5.8.4.21112, Zoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS) before version 5.8.4.21112, Zoom Meeting SDK for Android before version 5.7.6.1922, Zoom Meeting SDK for iOS before version 5.7.6.1082, Zoom Meeting SDK for macOS before version 5.7.6.1340, Zoom Meeting SDK for Windows before version 5.7.6.1081, Zoom Video SDK (for Android, iOS, macOS, and Windows) before version 1.1.2, Zoom On-Premise Meeting Connector Controller before version 4.8.12.20211115, Zoom On-Premise Meeting Connector MMR before version 4.8.12.20211115, Zoom On-Premise Recording Connector before version 5.1.0.65.20211116, Zoom On-Premise Virtual Room Connector before version 4.4.7266.20211117, Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5692.20211117, Zoom Hybrid Zproxy before version 1.0.1058.20211116, and Zoom Hybrid MMR before version 4.6.20211116.131_x86-64. This can potentially allow a malicious actor to crash the service or application, or leverage this vulnerability to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
Zoom Video Communications IncZoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)>= unspecified, < 5.8.4
Zoom Video Communications IncZoom Client for Meetings for Blackberry (for Android and iOS)>= unspecified, < 5.8.1
Zoom Video Communications IncZoom Client for Meetings for intune (for Android and iOS)>= unspecified, < 5.8.4
Zoom Video Communications IncZoom Client for Meetings for Chrome OS>= unspecified, < 5.0.1
Zoom Video Communications IncZoom Rooms for Conference Room (for Android, AndroidBali, macOS, and Windows)>= unspecified, < 5.8.3
Zoom Video Communications IncControllers for Zoom Rooms (for Android, iOS, and Windows)>= unspecified, < 5.8.3
Zoom Video Communications IncZoom VDI Windows Meeting Client>= unspecified, < 5.8.4
Zoom Video Communications IncZoom VDI Azure Virtual Desktop Plugins (for Windows x86 or x64, IGEL x64, Ubuntu x64, HP ThinPro OS x64)>= unspecified, < 5.8.4.21112
Zoom Video Communications IncZoom VDI Citrix Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS)>= unspecified, < 5.8.4.21112
Zoom Video Communications IncZoom VDI VMware Plugins (for Windows x86 or x64, Mac Universal Installer & Uninstaller, IGEL x64, eLux RP6 x64, HP ThinPro OS x64, Ubuntu x64, CentOS x 64, Dell ThinOS)>= unspecified, < 5.8.4.21112
Zoom Video Communications IncZoom Meeting SDK for Android>= unspecified, < 5.7.6.1922
Zoom Video Communications IncZoom Meeting SDK for iOS>= unspecified, < 5.7.6.1082
Zoom Video Communications IncZoom Meeting SDK for macOS>= unspecified, < 5.7.6.1340
Zoom Video Communications IncZoom Meeting SDK for Windows>= unspecified, < 5.7.6.1081
Zoom Video Communications IncZoom Video SDK (for Android, iOS, macOS, and Windows)>= unspecified, < 1.1.2
Zoom Video Communications IncZoom On-Premise Meeting Connector Controller>= unspecified, < 4.8.12.20211115
Zoom Video Communications IncZoom On-Premise Meeting Connector MMR>= unspecified, < 4.8.12.20211115
Zoom Video Communications IncZoom On-Premise Recording Connector>= unspecified, < 5.1.0.65.20211116
Zoom Video Communications IncZoom On-Premise Virtual Room Connector>= unspecified, < 4.4.7266.20211117
Zoom Video Communications IncZoom On-Premise Virtual Room Connector Load Balancer>= unspecified, < 2.5.5692.20211117
Zoom Video Communications IncZoom Hybrid Zproxy>= unspecified, < 1.0.1058.20211116
Zoom Video Communications IncZoom Hybrid MMR>= unspecified, < 4.6.20211116.131_x86-64

References

Timeline

Published
Nov 24, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-344247.5A vulnerability was discovered in the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.8.4, Zoom ClieCVE-2021-344256.1The Zoom Client for Meetings before version 5.7.3 (for Android, iOS, Linux, macOS, and Windows) contain a server side request forgery vulnerCVE-2021-344267.8A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" commCVE-2021-344279.8In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curreCVE-2021-344283.5For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thCVE-2021-344295.3For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the conCVE-2021-34435.5A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoCVE-2021-344307.5Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the masCVE-2021-344316.5In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to theCVE-2021-344327.5In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.CVE-2021-344337.5In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally suCVE-2021-344345.3In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a
CVE-2021-34423: Critical severity, CVSS 9.8 | Vulnix