CVE-2021-28133: Zoom Information Disclosure Vulnerability

CVE-2021-28133 Overview

CVE-2021-28133 is an information disclosure vulnerability in Zoom client versions through 5.5.4. The flaw affects the Share Screen functionality when a user shares a specific application window. Other meeting participants can briefly view contents of application windows that were never intended to be shared. The exposure occurs when non-shared windows overlay the shared window and momentarily gain focus. Attackers can capture this exposed content using third-party screen-recording applications for later analysis. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Meeting participants can observe unintended window contents, potentially exposing sensitive data such as credentials, private messages, or confidential documents that the presenter never chose to share.

Affected Products

Zoom Client through version 5.5.4
Zoom Desktop Client (Share Screen functionality)
Affected component: zoom:zoom

Discovery Timeline

2021-03-18 - CVE-2021-28133 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-28133

Vulnerability Analysis

The vulnerability resides in Zoom's selective window sharing feature. When a presenter chooses to share a single application window rather than the entire desktop, Zoom is expected to transmit only that window's contents. The client fails to consistently mask or clip overlapping windows that briefly come into focus on top of the shared window. During these brief moments, the Zoom client transmits the pixel data of the overlapping non-shared window to all meeting participants.

The disclosure window is short, but adversaries can record the entire meeting using an external screen recorder. Frame-by-frame analysis of the recording reveals the leaked content. This converts a transient rendering glitch into a persistent data exposure vector.

Root Cause

The root cause is improper window region handling within Zoom's screen-capture pipeline. The client captures the screen region occupied by the shared window rather than capturing the window's own backing surface. When another window overlaps the shared region, the captured frames include pixels belonging to the overlapping window. The application does not detect or redact the overlap before transmission.

Attack Vector

An attacker joins or hosts a Zoom meeting as a participant. The attacker passively observes the shared window while running an external screen-recording tool. When the presenter switches focus, drags windows, or receives notifications that overlay the shared window, the recorder captures the leaked frames. Post-meeting analysis extracts the exposed text, images, or UI state. No special privileges or exploit code are required. User interaction is limited to the presenter performing normal multitasking during a shared session.

No verified proof-of-concept code is published. Technical details are available in the SYSS Security Advisory 2020-044 and the Packet Storm Security Disclosure.

Detection Methods for CVE-2021-28133

Indicators of Compromise

Zoom client versions at or below 5.5.4 in active use across the environment
Meeting recordings showing momentary flashes of non-shared application content during single-window sharing
External screen-recording processes running on participant endpoints during Zoom sessions

Detection Strategies

Inventory installed Zoom client versions across managed endpoints and flag installations at or below 5.5.4
Monitor for unauthorized screen-recording utilities (OBS, ffmpeg, ScreenRecorder.exe) launched while Zoom meetings are active
Review meeting recordings for frames containing content that does not match the intended shared application

Monitoring Recommendations

Track Zoom client version distribution through endpoint management or asset inventory tooling
Alert on installation of screen-capture software on endpoints belonging to users who routinely present sensitive material
Audit meeting host and participant logs for sessions involving sensitive content discussion

How to Mitigate CVE-2021-28133

Immediate Actions Required

Upgrade all Zoom clients to a version later than 5.5.4 where the share-screen window clipping has been corrected
Enforce auto-update policies for Zoom across managed endpoints
Communicate safe-presenting guidance to users who share sensitive single-window content

Patch Information

Zoom addressed this issue in client versions released after 5.5.4. Consult the Zoom Security Bulletin for the specific fixed build and release notes. Additional context is available in the Hacker News Zoom Bug Report and the Full Disclosure Mailing List Post.

Workarounds

Share the entire desktop with rehearsed window discipline rather than selective window sharing when patching is delayed
Close or minimize all non-shared windows containing sensitive data before presenting
Disable desktop notifications, email pop-ups, and chat clients before initiating a share session
Use a dedicated presenter account or virtual machine with no sensitive content loaded

bash

# Configuration example: query installed Zoom version on Windows endpoints
reg query "HKCU\Software\Zoom\ZoomChat" /v ZoomVersion

# macOS: check Zoom client version
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleVersion