The vulnerability is an instance of External Control of File Name or Path (CWE‑73). It is present in the Mail feature of Zoom Workplace for Windows versions before 6.6.0. The description states that an unauthenticated user may supply a crafted file name or path that can lead to privilege escalation via network access. Based on the description, it is inferred that the application processes the supplied path in a manner that could allow the creation or modification of files with elevated privileges, enabling the attacker to gain higher privileges on the affected Windows system.

Zoom Communications’ Zoom Workplace application for Windows. All releases of the Windows client prior to version 6.6.0 are considered vulnerable. No specific patch version list is supplied; therefore, any installation of Zoom Workplace for Windows before 6.6.0 is at risk.

The CVSS score is 9.6, indicating a critical severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KeV catalog. Through the described path, an unauthenticated network user may exploit the flaw without any user interaction beyond connectivity to the Zoom Workplace service. Based on the description, the likely attack vector is network connectivity to the Zoom Workplace service. Organizations with affected versions should regard this as a high‑risk issue and prioritize remediation.