CVE-2024-39826: Zoom Workplace Apps and SDKs - Path traversal

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-15 · updated 2026-06-17
Weakness: CWE-367

Description

Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.

Affected products

Zoom Meeting Software Development Kit: before 6.0.0 — fixed in 6.0.0
Zoom Communications, Inc Zoom Workplace Desktop App for macOS: before 6.0.0 — fixed in 6.0.0
Zoom Communications Zoom Workplace VDI Plugin: before 5.17.13 — fixed in 5.17.13

How to fix

Upgrade to a fixed version: Zoom Meeting Software Development Kit 6.0.0; Zoom Communications, Inc Zoom Workplace Desktop App for macOS 6.0.0; Zoom Communications Zoom Workplace VDI Plugin 5.17.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-39826 or the next vulnerability affects your stack