Improper certificate validation within the My Notes feature of Zoom Clients allows an unauthenticated user to expose information over the network. The flaw permits the disclosure of data that the Zoom client may retrieve or transmit during normal operation, potentially revealing sensitive content that should remain confidential (inferred). The weakness is a classic instance of certificate validation failure (CWE-295).

Zoom Communications Zoom Clients are affected. No specific version range is provided, so all current releases that include the My Notes feature are potentially vulnerable until a fix is applied.

The CVSS score of 7.4 indicates a high severity for a vulnerability that can be exploited without authentication and can lead to information disclosure. EPSS data is not available, but the lack of a KEV listing suggests the vulnerability is not currently being actively exploited in the wild. The likely attack vector is network-based (inferred): a malicious server could present an invalid or spoofed certificate to a Zoom client using the My Notes feature, causing the client to accept it and transmit or receive data intended for a legitimate server. Because authentication is not required, any attacker with network access to the Zoom client could potentially exploit the flaw (inferred).