The flaw is an improper privilege management issue in certain Zoom Clients for Windows, allowing an authenticated local user to elevate privileges. This weakness is classified as CWE-269. An attacker who can log into the system could exploit this vulnerability to obtain higher-level permissions within the Zoom Workplace application.

Affected products are Zoom Communications Inc. Zoom Workplace client for Windows. Specific version numbers are not listed in the provided data, so all installed releases of Zoom Workplace on Windows may be vulnerable until a patch is applied.

The CVSS score of 7.8 indicates a high severity. EPSS indicates a low likelihood (<1%) of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires local authenticated access, as implied by the vendor description that an "authenticated user" can conduct an escalation of privilege. No additional exploitation conditions are stated in the input.