CVE-2021-34409: Zoom Client Installer Local Privilege Escalation

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-27 · updated 2026-06-17
Weakness: CWE-732

Description

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) installation before version 5.2.0, Zoom Client Plugin for Sharing iPhone/iPad before version 5.2.0, and Zoom Rooms for Conference before version 5.1.0, copy pre- and post- installation shell scripts to a user-writable directory. In the affected products listed below, a malicious actor with local access to a user's machine could use this flaw to potentially run arbitrary system commands in a higher privileged context during the installation process.

Affected products

Zoom Workplace: before 5.2.0 — fixed in 5.2.0
Zoom Video Communications, Inc. Zoom Rooms for Windows: before 5.1.0 — fixed in 5.1.0
Zoom Screen Sharing: before 5.2.0 — fixed in 5.2.0

How to fix

Upgrade to a fixed version: Zoom Workplace 5.2.0; Zoom Video Communications, Inc. Zoom Rooms for Windows 5.1.0; Zoom Screen Sharing 5.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-34409 or the next vulnerability affects your stack