CVE-2024-27241: Zoom Meeting SDK DOS Vulnerability

CVE-2024-27241 Overview

CVE-2024-27241 is an improper input validation vulnerability affecting multiple Zoom products, including Zoom Workplace, Zoom Rooms, and the Zoom Meeting Software Development Kit (SDK). An authenticated user can exploit the flaw over the network to trigger a denial of service condition against affected clients and services. The issue is tracked under [CWE-20: Improper Input Validation] and disclosed in Zoom Security Bulletin ZSB-24020.

Critical Impact

A network-adjacent authenticated attacker can degrade availability of Zoom client and SDK deployments across desktop, mobile, and VDI platforms, disrupting collaboration services.

Affected Products

• Zoom Meeting SDK (Android, iOS, Linux, macOS, Windows)
• Zoom Rooms (iPadOS, macOS, Windows) and Zoom Workplace (Android, iOS)
• Zoom Workplace Desktop (Linux, macOS, Windows) and Workplace VDI (Windows)

Discovery Timeline

• 2024-07-15 - CVE-2024-27241 published to NVD
• 2025-08-20 - Last updated in NVD database

Technical Details for CVE-2024-27241

Vulnerability Analysis

The vulnerability stems from improper input validation in components shared across Zoom's client applications and SDKs. An authenticated user supplies crafted input over the network, and the receiving Zoom process fails to validate the data before further handling. The result is a denial of service condition affecting availability without impacting confidentiality or integrity.

The weakness is classified under [CWE-20] and applies to Zoom Workplace, Zoom Workplace Desktop, Zoom Workplace VDI, Zoom Rooms, and the Zoom Meeting SDK. No public exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing or insufficient validation of network-supplied input within shared Zoom client and SDK code paths. When unexpected or malformed data reaches the vulnerable routine, the process enters an error state that halts normal operation rather than safely rejecting the input.

Attack Vector

The attack vector is network-based and requires the attacker to be authenticated, but no user interaction is needed on the target. An attacker joins or interacts with a Zoom session, then sends crafted traffic to participants or services running vulnerable client or SDK versions. Successful exploitation disrupts the targeted Zoom process, producing a denial of service against the meeting client, room device, or embedded SDK consumer.

No verified proof-of-concept code is published. Refer to Zoom Security Bulletin ZSB-24020 for vendor-confirmed technical scope.

Detection Methods for CVE-2024-27241

Indicators of Compromise

• Unexpected Zoom client or Zoom Rooms process crashes, hangs, or repeated restarts during active meetings.
• Repeated reconnect events from the same authenticated participant correlated with peer client failures.
• Crash dumps or Windows Error Reporting entries referencing Zoom.exe, CptHost.exe, or Zoom SDK modules.

Detection Strategies

• Monitor endpoint telemetry for abnormal termination of Zoom processes across managed desktops and VDI sessions.
• Correlate meeting join events with downstream client crashes to identify a single source disrupting multiple participants.
• Inventory installed Zoom Workplace, Rooms, and SDK-embedded application versions and flag builds predating the ZSB-24020 fix.

Monitoring Recommendations

• Forward Zoom client logs and OS crash telemetry to a centralized SIEM for correlation across users and sites.
• Track Zoom version compliance through configuration management tooling and alert on drift from the patched baseline.
• Alert on bursts of meeting disconnects originating from a single tenant account or external participant.

How to Mitigate CVE-2024-27241

Immediate Actions Required

• Upgrade all Zoom Workplace, Workplace Desktop, Workplace VDI, Zoom Rooms, and Meeting SDK installations to the fixed versions listed in ZSB-24020.
• Audit internally developed applications that embed the Zoom Meeting SDK and rebuild against a patched SDK release.
• Restrict external meeting participation where business requirements allow until clients are updated.

Patch Information

Zoom has released fixed versions for all affected products. Consult Zoom Security Bulletin ZSB-24020 for exact patched version numbers per platform and apply updates through managed software distribution or Zoom's auto-update mechanism.

Workarounds

• Enforce waiting rooms and authenticated-only meetings to limit who can send traffic to participants.
• Disable or restrict third-party Zoom Apps and SDK-based integrations until embedding applications are patched.
• Apply network-level rate limiting and segmentation around Zoom Rooms appliances to constrain exposure from untrusted endpoints.

# Example: enumerate Zoom client versions on Windows endpoints for patch compliance
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Zoom*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate