Local Privilege Escalation in the Zoom Rooms for Windows Client

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• zoom roomsbefore 5.11.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Zoom). Independent of NVD's CPE analysis and usually ahead of it.

• Zoom Video Communications Inc Zoom Room for Conference Room for Windows

  • unspecified and later · before 5.11.0affected

Other highest-scoring records for the same primary product.

• CVE-2023-34121Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow an authenticated
  35Monitor
• CVE-2024-39825Zoom Workplace Apps and Rooms Clients - Buffer Overflow
  34Monitor
• CVE-2026-53409Improper Privilege Management in Zoom Rooms for Windows before version 7.1.0 may allow an authenticated user to conduct an escalation of pri
  31Monitor
• CVE-2026-30906Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escalati
  31Monitor
• CVE-2026-30902Zoom Clients for Windows - Improper Privilege Management
  31Monitor
• CVE-2026-30901Zoom Rooms for Windows - Improper Input Validation
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The verifier takes the algorithm to verify with from the token’s own header. Untrusted data ends up deciding its own verification rule.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const claims = jwt.verify(token, publicKey);

1const claims = jwt.verify(token, publicKey, {2  algorithms: ["RS256"],3  issuer: "https://id.example.com",4  audience: "portal",5});

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.