CVE-2024-45422: Zoom Meeting SDK DOS Vulnerability

CVE-2024-45422 Overview

CVE-2024-45422 is an improper input validation vulnerability affecting multiple Zoom applications and SDKs prior to version 6.2.0. This vulnerability allows an unauthenticated attacker to conduct a denial of service attack via network access. The flaw exists across a wide range of Zoom products spanning multiple operating systems including Windows, macOS, Linux, iOS, iPadOS, and Android platforms.

Given Zoom's widespread adoption in enterprise environments for video conferencing and collaboration, this vulnerability poses a significant risk to business continuity. An attacker could disrupt critical communications by exploiting the improper input validation, causing affected Zoom applications to become unresponsive or crash.

Critical Impact

Unauthenticated attackers can remotely trigger denial of service conditions across multiple Zoom platforms, potentially disrupting enterprise communications and collaboration workflows.

Affected Products

• Zoom Meeting Software Development Kit (Android, iOS, Linux, macOS, Windows) - versions before 6.2.0
• Zoom Rooms (iPadOS, macOS, Windows) - versions before 6.2.0
• Zoom Rooms Controller (Android, Linux, macOS, Windows) - versions before 6.2.0
• Zoom Video Software Development Kit (Android, iOS, Linux, macOS, Windows) - versions before 6.2.0
• Zoom Workplace (Android, iOS) - versions before 6.2.0
• Zoom Workplace Desktop (Linux, macOS, Windows) - versions before 6.2.0

Discovery Timeline

• 2024-11-19 - CVE-2024-45422 published to NVD
• 2025-08-19 - Last updated in NVD database

Technical Details for CVE-2024-45422

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation), indicating that the affected Zoom applications fail to properly validate, filter, or sanitize input data before processing. When exploited, this flaw allows network-accessible attackers to send specially crafted input that the application cannot handle correctly, resulting in a denial of service condition.

The vulnerability is particularly concerning because it requires no authentication to exploit. An attacker simply needs network access to the target Zoom application to initiate an attack. The impact is limited to availability—there is no compromise of confidentiality or integrity—but the ability to disrupt Zoom communications can have significant business impact in organizations relying on the platform for critical meetings and collaboration.

Root Cause

The root cause of CVE-2024-45422 is improper input validation within the affected Zoom applications. The application fails to implement adequate boundary checks or input sanitization routines, allowing malformed or unexpected input to trigger error conditions that result in service disruption. This type of vulnerability typically occurs when input handling code assumes data will conform to expected formats without implementing defensive programming practices to handle edge cases or malicious input.

Attack Vector

The attack vector is network-based, allowing remote exploitation without requiring user interaction or authentication. An attacker can target Zoom applications that are accessible over the network by sending maliciously crafted data designed to trigger the input validation flaw.

The attack requires low complexity to execute and can be performed by unauthenticated users, making it accessible to a wide range of potential attackers. The scope is unchanged, meaning the vulnerable component and impacted component are the same. While the vulnerability does not enable data exfiltration or modification, it can cause complete service unavailability for the affected Zoom application.

The vulnerability affects input processing routines in Zoom applications. When the application receives network data that fails to conform to expected validation parameters, it enters an error state that results in denial of service. For specific technical implementation details, refer to the Zoom Security Bulletin ZSB-24044.

Detection Methods for CVE-2024-45422

Indicators of Compromise

• Unexpected Zoom application crashes or unresponsive behavior, particularly during network activity
• Increased error logs in Zoom application log files indicating input parsing failures
• Network traffic patterns showing repeated connection attempts to Zoom services from suspicious sources
• System logs indicating abnormal resource consumption by Zoom processes prior to service interruption

Detection Strategies

• Monitor Zoom application processes for unexpected terminations or restart patterns that may indicate exploitation attempts
• Implement network intrusion detection rules to identify anomalous traffic patterns targeting Zoom application ports
• Configure endpoint detection and response (EDR) solutions to alert on Zoom process crashes correlated with incoming network connections
• Review application logs for repeated input validation errors or exception handling events

Monitoring Recommendations

• Deploy SentinelOne agents to detect and alert on suspicious behavior targeting Zoom applications
• Establish baseline metrics for Zoom application availability and alert on deviations
• Implement network traffic analysis to identify potential denial of service attack patterns
• Configure centralized logging for all Zoom application instances to enable correlation of crash events across the environment

How to Mitigate CVE-2024-45422

Immediate Actions Required

• Update all affected Zoom applications to version 6.2.0 or later immediately
• Inventory all Zoom installations across the enterprise to identify vulnerable versions
• Prioritize patching for internet-facing Zoom installations and conference room systems
• Enable automatic updates for Zoom applications where organizationally appropriate

Patch Information

Zoom has released version 6.2.0 across all affected products to address this vulnerability. The update is available through standard Zoom update channels and direct download from Zoom's website. Organizations should consult the Zoom Security Bulletin ZSB-24044 for complete details on the patch and affected version information.

All organizations using Zoom products should verify their deployed versions and update to 6.2.0 or later. This applies to all affected products including Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, Meeting SDK, and Video SDK across all supported platforms.

Workarounds

• Implement network segmentation to limit exposure of Zoom applications to untrusted networks
• Configure firewalls to restrict access to Zoom services from known and trusted IP ranges where feasible
• Deploy network-based rate limiting to mitigate potential denial of service attack attempts
• Consider disabling affected Zoom components in high-security environments until patching is complete

# Verify Zoom version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" | 
    Where-Object { $_.DisplayName -like "*Zoom*" } | 
    Select-Object DisplayName, DisplayVersion

# Verify Zoom version on macOS
/Applications/zoom.us.app/Contents/Info.plist | grep -A1 CFBundleShortVersionString