The vulnerability resides in Zoom Rooms for Windows operating in Kiosk Mode before version 6.6.5. Improper input validation permits an authenticated local user to manipulate data in a way that elevates their privileges on the host system. This flaw is classified as CWE‑20 (Improper Input Validation) and can lead to unauthorized actions that compromise the integrity of the entire installation.

Affecting all Zoom Communications Inc. Zoom Rooms deployments for Windows running in Kiosk Mode. Any instance of Zoom Rooms earlier than version 6.6.5 is impacted. The product is typically used in environments where users can log in locally to the host machine.

The CVSS score of 7 denotes high severity, but the EPSS score of less than 1% indicates a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Attackers must have local authenticated access to exploit the flaw; no remote network access is required. In high‑density user environments the risk escalates, yet the overall likelihood of concrete exploitation remains low.