CVE-2022-28750: Zoom On-Premise Deployments: Stack Buffer Overflow in Meeting Connector

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-08-11 · updated 2026-06-17
Weakness: CWE-121

Description

Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.

Affected products

Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC): before 4.8.20220419.112 — fixed in 4.8.20220419.112

How to fix

Upgrade to a fixed version: Zoom Video Communications Inc Zoom On-Premise Meeting Connector Zone Controller (ZC) 4.8.20220419.112. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-28750 or the next vulnerability affects your stack