What’s Vulnerable › Vulnerabilities

CVE-2024-24699: Zoom Clients - Business Logic Error

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-14 · updated 2026-06-17

Description

Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.

Affected products

• Zoom Video Communications, Inc. Zoom Meeting SDK: before 5.16.5 — fixed in 5.16.5
• Zoom Video Communications, Inc. Zoom Rooms for Windows: before 5.17.0 — fixed in 5.17.0
• Zoom Vdi Windows Meeting Clients: before 5.15.15; from 5.15.15 (excl.) before 5.16.10; from 5.16.10 (excl.) before 5.17.5 — fixed in 5.15.15, 5.16.10, 5.17.5
• Zoom Video Communications, Inc. Zoom Desktop Client for Windows: before 5.16.5 — fixed in 5.16.5

How to fix

Upgrade to a fixed version: Zoom Video Communications, Inc. Zoom Meeting SDK 5.16.5; Zoom Video Communications, Inc. Zoom Rooms for Windows 5.17.0; Zoom Vdi Windows Meeting Clients 5.15.15, 5.16.10, 5.17.5; Zoom Video Communications, Inc. Zoom Desktop Client for Windows 5.16.5. Check the vendor advisory for mitigations.

References

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/
• https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/

Get alerted when CVE-2024-24699 or the next vulnerability affects your stack