Zoom fixes three high-severity flaws in Workplace and Rooms apps

Zoom fixes three high-severity flaws in Workplace and Rooms apps

13 October 2026: Zoom has published three high-severity security bulletins for its Workplace desktop and mobile apps and Zoom Rooms, fixed in version 7.2.0 and, for the 7.1 line, 7.1.9. The most serious, CVE-2026-53420, is a buffer overflow in a Zoom Phone feature that can lead to privilege escalation over the network.

Not yet independently verified. Zoom's bulletins do not report exploitation; the buffer overflow's description says an unauthenticated user could exploit it while its CVSS vector assumes low privileges, so the exact preconditions are unclear. We will update this when it can be confirmed, and remove this note.

The three flaws

Bulletin	CVE	Issue	CVSS 3.1
ZSB-26020	CVE-2026-53420	Buffer overflow in a Zoom Phone feature of Workplace clients	8.0
ZSB-26021	CVE-2026-108184	Improper certificate validation in Zoom clients for Windows	7.4
ZSB-26022	CVE-2026-108185	Improper certificate validation in the My Notes feature	7.4

The buffer overflow, reported by Kasif Dekel of Neo Security, affects Zoom Workplace on all supported platforms before 7.2.0. Zoom's description says it "may allow an unauthenticated user to conduct a escalation of privilege via network access"; the score assumes a network attacker with low privileges, high attack complexity and some user interaction. The two certificate flaws, found by Zoom's own offensive security team, can lead to information disclosure: a client that does not properly check a server's certificate can be fooled by an attacker positioned on the network.

Affected versions

• ZSB-26020: Zoom Workplace, all supported platforms, before 7.2.0.
• ZSB-26021: Zoom Workplace for Windows from 7.0.0 and before 7.2.0 and 7.1.9 in their branches; Zoom Workplace VDI Client for Windows from 7.0.11 and before 7.0.13; Zoom Rooms for Windows from 7.0.0 and before 7.1.7.
• ZSB-26022: Zoom Workplace for Windows from 7.1.5, and for macOS and Linux from 7.0.5, before 7.2.0 and 7.1.9 in their branches; Android and iOS from 7.0.5 and before 7.2.0.

Where updates stall

Zoom tells users to install the latest version from its download page. Personal installs usually update themselves, but managed fleets often do not: IT teams that package the client, pin VDI images or run Zoom Rooms appliances in meeting rooms control the version themselves, and the Rooms and VDI fixes have their own version numbers. The flaws were published on 13 October and no exploitation has been reported. Our video conferencing software category lists the alternatives we track.

Sources

• Zoom: Security bulletin ZSB-26020, buffer overflow in Zoom Workplace clients, 13 October 2026
• Zoom: Security bulletin ZSB-26021, improper certificate validation in Zoom clients for Windows, 13 October 2026
• Zoom: Security bulletin ZSB-26022, improper certificate validation in My Notes, 13 October 2026