This vulnerability is a TOCTOU race condition in the installation and uninstallation processes of certain Zoom Clients for Windows. It allows an authenticated local user to potentially escalate privileges by exploiting the timing window between checking and using resources during these processes. The CVSS vector indicates that the attack requires local access with high attack complexity and low privileges but no user interaction. The impact includes high confidentiality, integrity, and availability consequences. No vendor advisory or patch information is currently available, and affected versions are unspecified.

An authenticated local user could exploit this race condition to escalate privileges, potentially gaining higher system rights than intended. This could lead to unauthorized access to sensitive information, modification of system or application data, and disruption of service availability on affected Windows systems running Zoom Clients.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by Zoom Communications, restrict local user access to trusted individuals and monitor for unusual privilege escalation attempts. Avoid running installation or uninstallation processes in untrusted environments.