CVE-2022-36925: Insecure key generation for Zoom Rooms for macOS Clients

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-09 · updated 2026-06-17
Weakness: CWE-321

Description

Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon service and the Zoom Rooms client was generated using parameters that could be obtained by a local low-privileged application. That key can then be used to interact with the daemon service to execute privileged functions and cause a local denial of service.

Affected products

Zoom Video Communications, Inc. Zoom Rooms for Windows: before 5.11.4 — fixed in 5.11.4

How to fix

Upgrade to a fixed version: Zoom Video Communications, Inc. Zoom Rooms for Windows 5.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-36925 or the next vulnerability affects your stack