Vulnerability · Published Jun 15, 2022 · Assigned by Zoom

CVE-2022-22788DLL injection in Zoom Opener installer for Zoom and Zoom Rooms clients

High 7.1

In plain English

A high-severity security flaw in All Zoom Rooms for Conference Room for Windows from Zoom Video Communications Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)1.5%top 25.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host.

Affected products (as reported)

Vendor	Product	Versions
Zoom Video Communications Inc	Zoom Client for Meetings	unspecified – before 5.10.3
Zoom Video Communications Inc	All Zoom Rooms for Conference Room for Windows	unspecified – before 5.10.3

References

https://explore.zoom.us/en/trust/security/security-bulletin/ x_refsource_MISC