Zoom Addresses Critical Privilege Escalation Vulnerabilities in Windows Workplace Software
Security updates resolve two high-severity flaws allowing unauthorized remote access to Windows systems.
1Critical Security Updates Released
Zoom has issued urgent security patches for its Workplace for Windows application to address two distinct privilege escalation vulnerabilities. These flaws allow unauthenticated remote attackers to gain elevated system permissions without requiring user interaction or prior account access. Users are strongly advised to update their software immediately to mitigate these risks.
2Input Validation Flaw Details
The most severe vulnerability, tracked as CVE-2026-108186, carries a critical CVSS score of 9.6. This input validation error impacts versions from 7.1.0 up to 7.1.8. By sending specially crafted messages, attackers can corrupt system memory, potentially executing unauthorized code, stealing sensitive data, or activating hardware like cameras and microphones remotely.
3Origin Validation Vulnerability Scope
A second issue, CVE-2026-108187, involves an origin validation flaw with a CVSS score of 8.1. This vulnerability affects Zoom Workplace for Windows releases earlier than version 7.1.5. Like the primary flaw, it enables unauthenticated remote attackers to escalate their privileges, posing a significant threat to the security of affected Windows systems.
4Discovery and Reporting Sources
The identification of these security gaps involved both internal and external efforts. The critical input validation flaw was discovered by Zoom’s internal security team, while the origin validation issue was reported by the research group known as shmoul. These collaborative efforts are essential for identifying complex memory corruption bugs before active exploitation occurs.
5Recent History of Vulnerabilities
This update follows a series of security challenges for the platform throughout the summer. In July, Zoom patched CVE-2026-53412, a critical flaw with a 9.8 CVSS score that allowed account hijacking. Additionally, an August update addressed a zero-click memory corruption issue dubbed Zoomsday, which impacted all platforms including Windows, Mac, and Linux.
6Technical Impact of Exploitation
Successful exploitation of these vulnerabilities enables attackers to bypass standard security controls. By leveraging memory corruption, malicious actors can execute arbitrary code on a victim's machine without the user clicking any links or downloading files. This level of control allows for persistent malware installation and unauthorized access to private meeting participant data.
7Current Threat Landscape Status
Despite the severity of these vulnerabilities, Zoom has stated that they are currently unaware of any active exploitation in the wild. The company continues to monitor the situation closely while urging all users to apply the latest patches. Maintaining updated software remains the primary defense against these remote privilege escalation attack vectors.
8Proactive Security Maintenance Requirements
The recurring nature of these critical flaws highlights the importance of consistent software maintenance. As Zoom continues to address memory corruption and validation errors, users must prioritize installing updates for the Windows VDI Client and Meeting SDK. Regular patching is the only effective method to close these identified identity and access gaps.