Tuesday, April 29, 2025
HomeSecurity UpdatesGoogle Details Two Zero-Click Bugs in Zoom Clients That Let Attackers Execute...

Google Details Two Zero-Click Bugs in Zoom Clients That Let Attackers Execute Malicious Code

Published on

SIEM as a Service

Follow Us on Google News

Two zero-click bugs in Zoom clients have been detected recently by the security analyst Natalie Silvanovich of Google’s Project Zero that enables the threat actors to execute malicious code.

By exploiting these security flaws, the attackers target the:-

  • Zoom clients
  • Multimedia Router (MMR) servers

With the help of these two elements, the audio and video content between clients is transmitted. While after patching them, the company has recently activated the ASLR. 

- Advertisement - Google News

On successful exploitation of these two zero-click bugs, the threat actors can achieve control over the device of their victim that also without any kind of interaction from the user end.

Flaw Profile

  • CVE ID: CVE-2021-34423
  • Description: A buffer overflow vulnerability that can be leveraged to crash the service or application or execute arbitrary code.
  • CVSS score: 9.8
  • Severity: Critical
  • CVE ID: CVE-2021-34424
  • Description: A process memory exposure flaw that could be used to potentially gain insight into arbitrary areas of the product’s memory.
  • CVSS score: 7.5
  • Severity: High

Exploit

An attacker can manipulate the contents of a buffer by exploiting these bugs, and this could be executed by sending a malformed chat message to crash the client and MMR server.

Not only that even, by joining a Zoom meeting via a web browser, it is also possible to leak data from memory, and this happens due to the lack of a NULL check. 

Here’s what the security expert, Natalie Silvanovich stated:-

“The lack of ASLR in the Zoom MMR process greatly increased the risk that an attacker could compromise it. ASLR is arguably the most important mitigation in preventing exploitation of memory corruption, and most other mitigations rely on it on some level to be effective. There is no good reason for it to be disabled in the vast majority of software.”

Zoom has a closed nature, and its closed nature greatly affected this investigation. Since most of the video conferencing systems use the open-source software:-

  • WebRTC
  • PJSIP

These open-source software platforms are not bug-free, but since they are open-source, so, they could be easily rectified by vendors and analysts.

Moreover, one of the most interesting key features of zero-click attacks, they don’t leave any footprints or traces of any malicious activity; in short, they create such a complexity due to which it becomes very difficult to detect them.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Viasat Modems Zero-Day Vulnerabilities Let Attackers Execute Remote Code

A severe zero-day vulnerability has been uncovered in multiple Viasat satellite modem models, including...

Hackers Exploit Ivanti Connect Secure 0-Day to Deploy DslogdRAT and Web Shell

Threat actors exploited a zero-day vulnerability in Ivanti Connect Secure, identified as CVE-2025-0282, to...

Google Warns: Threat Actors Growing More Sophisticated, Exploiting Zero-Day Vulnerabilities

Google’s Mandiant team has released its M-Trends 2025 report, highlighting the increasing sophistication of...