CVE-2026-53412

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Zoom Communications	Zoom Workplace for Windows	< 7.0.0

References

https://www.zoom.com/en/trust/security-bulletin/zsb-26014Vendor Advisory

Timeline

Published: Jul 16, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-534138.3Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve re CVE-2026-534146.5Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a d CVE-2026-534158.3Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another partici CVE-2026-534167.1Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.CVE-2026-534188.1Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user CVE-2026-53425.3A flaw has been found in LibRaw up to 0.22.0. This affects the function LibRaw::nikon_load_padded_packed_raw of the file src/decoders/decode CVE-2026-534208.0Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via CVE-2026-534219.8Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remot CVE-2026-534224.3Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existe CVE-2026-534235.9Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4_plugin allows unauthenticated denial-of CVE-2026-534249.1Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML CVE-2026-534257.6Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using