Zoom stomps critical privilege escalation bug plus 6 other flaws

Video conferencing giant Zoom today opened up about a fresh batch of security vulnerabilities affecting its products, including a critical privilege escalation flaw. Tracked as CVE-2024-24691 with a CVSS score of 9.6, Zoom says the vulnerability may enable privilege escalation for unauthenticated users via network access. Limited technical details were disclosed, but an examination of the exploitability metrics that influenced the severity score shows that Zoom believes an exploit would require little complexity to execute, although some user interaction may be required. It's also deemed to have a potentially high impact on affected products, which include the Windows versions of the Zoom desktop client, VDI client, Rooms client, and Zoom Meeting SDK. Zoom Desktop Client for Windows before version 5.16.5 Zoom VDI Client for Windows before version 5.16.10 (excluding 5.14.14 and 5.15.12) Zoom Rooms Client for Windows before version 5.17.0 Zoom Meeting SDK for Windows before version 5.16.5 The vulnerability was reported by researchers in Zoom's Offensive Security division, and the company hasn't said whether any in-the-wild exploitation was detected. In any case, the severity of the vulnerability should be a cause for concern and prompt users into patching to the latest version. Also included in the round of updates were improper input validation vulnerabilities, as well as assorted others, although these were mostly all medium-severity issues, bar one. The other now-patched vul...