Vulnerability Spotlight: Two vulnerabilities in Zoom could lead to code execution
Summary: Cisco Talos discovered two vulnerabilities in Zoom Client version 4.6.10 that could allow a malicious user to execute arbitrary code on victims' machines. TALOS-2020-1056, a path traversal flaw in the processing of messages containing animated GIFs, was fixed in May, while TALOS-2020-1055, a partial path traversal in the handling of shared code snippets, was fixed server-side but Talos believes still requires a client-side fix.
Bottom line: Both flaws are triggered by a specially crafted chat message sent to a target user or group, meaning the attack arrives through the same chat feature employees use every day, and one of the two fixes is still incomplete on the client side.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-6110
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026