CVE-2022-22784: Improper XML Parsing in Zoom Client for Meetings

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-18 · updated 2026-06-17
Weakness: CWE-91

Description

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.

Affected products

Zoom Workplace: before 5.10.0 — fixed in 5.10.0

How to fix

Upgrade to a fixed version: Zoom Workplace 5.10.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-22784 or the next vulnerability affects your stack