A race condition in the ZPA tunnel handler of Zscaler Client Connector can corrupt heap memory, causing client crashes and potentially enabling arbitrary code execution within the ZCC process. The flaw is a classic use‑after‑free or double‑free scenario under concurrent tunnel activity and is identified as CWE‑366.

The vulnerability affects the Zscaler Client Connector product. No specific version ranges are listed in the advisory, so all editions of the connector that include the ZPA tunnel feature are potentially impacted until a patch is applied.

The CVSS score of 8.1 reflects a high impact, and the EPSS score of < 1% indicates a very low exploitation probability. The issue is not cataloged in CISA KEV, suggesting it is not a known, actively exploited vulnerability at this time. Based on the description, the likely attack vector requires an attacker to manipulate tunnel traffic or perform concurrent client operations to trigger the race, making remote exploitation plausible but potentially dependent on network configurations that allow such traffic.