CVE-2022-28766

Summary

CVE	CVE-2022-28766
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-11-17 23:15:00 UTC
Updated	2022-11-22 16:14:00 UTC
Description	Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injection vulnerability. A local low-privileged user could exploit this vulnerability to run arbitrary code in the context of the Zoom client.

Risk And Classification

Problem Types: CWE-427

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Zoom	Meetings	All	All	All	All
Application	Zoom	Rooms	All	All	All	All

References

Reference	Source	Link	Tags
Security Bulletins \| Zoom	MISC	explore.zoom.us
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

377777 Zoom Client for Meetings Multiple Security Vulnerabilities (ZSB-22027)
377783 Zoom VDI DLL Injection Vulnerability (ZSB-22027)
377784 Zoom Rooms for Conference Room DLL Injection Vulnerability (ZSB- 22027)