The vulnerability is a classic buffer overflow in the Zoom Phone feature of Zoom Workplace clients. An unauthenticated user can trigger the overflow, leading to an escalation of privileges on the affected system. The weakness is classified as CWE-120, indicating a lack of bounds checking on data input.

Zoom Communications’ Zoom Workplace product is impacted. No specific client or server versions are listed, so the flaw may exist across all releases that still ship the Zoom Phone feature.

The vulnerability carries a CVSS score of 8, indicating high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based attack from an unauthenticated user who can reach the Zoom Phone service. Exploitation would require sending crafted data over the network to the Zoom Workplace client, exploiting the buffer overflow to gain elevated privileges on the local machine.