Information Disclosure in Zoom for Windows Clients

CVE-2023-22880

Summary

Zoom for Windows clients prior to version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5, and Zoom VDI for Windows clients before version 5.13.1 are susceptible to an information disclosure flaw. This issue arises from a recent update to the Microsoft Edge WebView2 runtime utilized by Zoom, where sensitive text data was inadvertently sent to Microsoft's online Spellcheck service instead of being processed locally. To mitigate this vulnerability, users are advised to update their Zoom application to the latest version, which disables the problematic feature, and also ensure that their Microsoft Edge WebView2 runtime is updated to at least version 109.0.1481.0.

References