Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2023-22880

Information Disclosure in Zoom for Windows Clients

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zoom

Description

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zoom Video Communications Inc Zoom for Windows

  • unspecified to < 5.13.3affected

Zoom Video Communications Inc Zoom Rooms for Windows

  • unspecified to < 5.13.3affected

Zoom Video Communications Inc Zoom VDI for Windows

  • unspecified to < 5.13.1affected

References