CVE-2026-53411

Received Received - Intake

TOCTOU Race Condition in Zoom Client for Windows

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: Zoom Video Communications, Inc.

Description

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-16

Generated

2026-07-17

AI Q&A

2026-07-17

EPSS Evaluated

N/A

NVD

CVE-2026-53411

Affected Vendors & Products

Vendor	Product	Version / Range
zoom	zoom_client	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This is a time-of-check to time-of-use (TOCTOU) race condition in Zoom Clients for Windows. It occurs during installation or uninstallation, where an authenticated local user could exploit timing issues to escalate their privileges on the system.

Impact Analysis

An attacker with local access could gain elevated privileges, potentially allowing them to take control of your system, install malicious software, or access sensitive data.

Compliance Impact

This vulnerability allows local privilege escalation, which could lead to unauthorized access to sensitive data. For GDPR, this may impact data confidentiality and integrity requirements. For HIPAA, it could compromise protected health information if exploited. However, specific compliance impacts depend on implementation and mitigation measures.

Mitigation Strategies

Update Zoom Clients for Windows to the latest version immediately to patch the TOCTOU race condition. Ensure all users avoid running Zoom with elevated privileges and monitor for unusual privilege escalation attempts.

Hi! I’m here to help you understand CVE-2026-53411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70