CVE-2026-53420: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Zoom Communications Zoom Workplace

This vulnerability is a classic buffer overflow (CWE-120) in the Zoom Phone feature of Zoom Workplace Clients. An unauthenticated user can exploit this flaw remotely over the network to escalate privileges. The issue is due to copying data into a buffer without verifying the input size, leading to memory corruption. The vulnerability affects all versions of Zoom Workplace prior to 7.2.0. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and no patch links are provided in the input data.

Successful exploitation could allow an unauthenticated attacker to escalate privileges on the affected system, potentially gaining higher-level access. The vulnerability impacts confidentiality, integrity, and availability of the Zoom Workplace client environment. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor Zoom Communications' advisories for updates. Until a fix is available, restricting network access to Zoom Workplace clients and applying defense-in-depth controls may reduce exposure.