Zoom Windows clients improperly validate TLS certificates, allowing an unauthenticated attacker to obtain sensitive information during network communication. The vulnerability stems from the use of weak certificate checks and can result in the leaking of session data or other confidential content accessed via Zoom. Because the flaw is in the client certificate verification process, any user scanning the network could exploit it to read data in transit or to trick the client into trusting malicious certificates.

Zoom Communications’ Zoom Clients for Windows are affected. No specific version information is provided, so all installations of the Zoom client for Windows may be vulnerable until a patch is applied.

The CVSS score of 7.4 indicates a high‑severity flaw; the EPSS score is not published, and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is over the network, where an unauthenticated user could deliver a forged certificate. Exploitation requires only network access to a Zoom client that fails to perform proper certificate validation.