CVE-2023-22880

Information Disclosure in Zoom for Windows Clients

State: Published
Severity: 6.8 Medium
Published: Mar 16, 2023
Updated: Feb 26, 2025
Reserved: Jan 9, 2023

Description

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N	Zoom

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Zoom for WindowsZoom Video Communications Inc	before 5.13.3Affected
Zoom Rooms for WindowsZoom Video Communications Inc	before 5.13.3Affected
Zoom VDI for WindowsZoom Video Communications Inc	before 5.13.1Affected

References

https://explore.zoom.us/en/trust/security/security-bulletin/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.