Zoom zero day flaw exposes Windows computers

A zero-day vulnerability in the 'Zoom for Windows' client may be exploited by an attacker to execute arbitrary code on a victim’s computer. The attack doesn’t trigger a security warning and can be pulled off by getting the victim to perform a typical action such as opening a received document file.

The vulnerability was discovered by an unnamed researcher and reported to Acros Security, who reported it to Zoom earlier today.

Is is present in all supported versions of the Zoom client for Windows, and the 0patch team created a micropatch for all (starting with v5.0.3 and all up to the latest one – v5.1.2).

The flaw is only exploitable if the client is installed on Windows 7 and older Windows systems, due to a specific system property.

“The flaw is likely also exploitable on Windows Server 2008 R2 and earlier though we didn’t test that; either way, our micropatch will protect you wherever you’re using the Zoom client,” Acros Security CEO Mitja Kolsek told Help Net Security. As per video below.

Please, where possible, move your family members off Windows 7. If that's not possible, then stop using Zoom, and update it to the latest version.

Zoom's latest release notes say:

“Zoom addressed this issue, which impacts users running Windows 7 and older, in the 5.1.3 client release on July 10,” the company announced.

“Users can help keep themselves secure by applying current updates or downloading the latest Zoom software with all current security updates from https://zoom.us/download.”