CVE-2024-45419: Zoom Meeting SDK Info Disclosure Flaw

CVE-2024-45419 Overview

CVE-2024-45419 is an improper input validation vulnerability affecting multiple Zoom client applications and SDKs. The flaw allows an unauthenticated remote attacker to trigger information disclosure over the network without user interaction. Zoom published advisory ZSB-24041 describing the issue, which maps to [CWE-252] Unchecked Return Value as the underlying weakness class. Affected products span Zoom Workplace, Zoom Workplace Desktop, Zoom Workplace VDI, Zoom Rooms, Zoom Rooms Controller, the Meeting SDK, and the Video SDK across Windows, macOS, Linux, Android, iOS, and iPadOS.

Critical Impact

An unauthenticated network attacker can exploit improper input validation in Zoom applications to disclose sensitive information without requiring privileges or user interaction.

Affected Products

• Zoom Workplace and Zoom Workplace Desktop (Windows, macOS, Linux, Android, iOS)
• Zoom Workplace VDI for Windows
• Zoom Rooms, Rooms Controller, Meeting SDK, and Video SDK across supported platforms

Discovery Timeline

• 2024-11-19 - CVE-2024-45419 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2024-45419

Vulnerability Analysis

The vulnerability stems from improper input validation in several Zoom client applications and SDKs. According to the Zoom advisory, an unauthenticated attacker can send crafted network input that the application processes without adequate validation. The result is unintended disclosure of information from the affected client.

The weakness is classified as [CWE-252] Unchecked Return Value, indicating that code paths inside the affected Zoom components fail to verify the result of an operation before continuing. When attacker-controlled input drives one of these paths, the application can expose data that should remain internal to the process or session.

The attack surface is wide because the same defect appears across desktop, mobile, VDI, Rooms, and SDK builds. Confidentiality is impacted, while integrity and availability are not affected per the CVSS vector published by Zoom.

Root Cause

The root cause is missing or insufficient validation of input received over the network, combined with unchecked return values in downstream processing. Affected code paths in Zoom Workplace, Zoom Rooms, and the Meeting and Video SDKs accept data from a remote source and act on it without confirming that prior validation or parsing steps succeeded.

Attack Vector

The attack vector is network-based and requires no authentication, no privileges, and no user interaction. An attacker reachable on the network path to the Zoom client sends malformed input to a listening or actively connected component. The affected component mishandles the input and leaks information back to the attacker or into observable channels.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical exploitation details have not been released by Zoom. See the Zoom Security Bulletin ZSB-24041 for the vendor's description.

Detection Methods for CVE-2024-45419

Indicators of Compromise

• No public indicators of compromise have been published by Zoom for CVE-2024-45419.
• Unexpected outbound connections from Zoom client processes to non-Zoom infrastructure may warrant investigation.
• Anomalous crash or error telemetry from Zoom.exe, zoom, or Zoom Rooms processes following inbound network activity.

Detection Strategies

• Inventory all Zoom Workplace, Zoom Rooms, Meeting SDK, and Video SDK installations and compare versions against the fixed releases listed in ZSB-24041.
• Monitor endpoint telemetry for Zoom client processes initiating unusual network connections or generating repeated parsing errors.
• Correlate Zoom client crashes with network events from external sources outside known Zoom address ranges.

Monitoring Recommendations

• Forward Zoom client and operating system logs to a centralized analytics platform to baseline normal behavior.
• Track software version drift across managed endpoints to identify hosts that have not received the Zoom patch.
• Alert on Zoom client processes spawning unexpected child processes or accessing files outside their normal working directories.

How to Mitigate CVE-2024-45419

Immediate Actions Required

• Update all Zoom Workplace, Workplace Desktop, Workplace VDI, Rooms, Rooms Controller, Meeting SDK, and Video SDK installations to the fixed versions listed in Zoom advisory ZSB-24041.
• Prioritize patching internet-facing or shared-use systems such as Zoom Rooms appliances and VDI images.
• Rebuild and redistribute any internal applications that embed the Zoom Meeting SDK or Video SDK with the patched SDK versions.

Patch Information

Zoom has issued fixes in the security bulletin Zoom Security Bulletin ZSB-24041. Administrators should consult the bulletin for the specific minimum fixed version per product and platform, then deploy through standard software distribution channels.

Workarounds

• No vendor-supplied workaround is documented; patching is the supported remediation path.
• Restrict Zoom client exposure to untrusted networks where feasible until updates are deployed.
• Enforce automatic updates for the Zoom client through group policy or mobile device management to reduce time-to-patch.

# Example: query installed Zoom version on Windows endpoints via PowerShell
Get-ItemProperty "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Zoom*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation