CVE-2023-49647 is a high severity (CVSS 8.8) improper access control flaw in Zoom clients and SDKs for Windows before version 5.16.10. An authenticated local user can escalate privileges. Zoom's bulletin ZSB-24001 lists 5.16.10 as the fixed version, so update every affected Windows install.
What's affected
Zoom bulletin ZSB-24001 lists these products as affected before 5.16.10: Zoom Desktop Client for Windows, Zoom VDI Client for Windows, Zoom Video SDK for Windows and Zoom Meeting SDK for Windows. For the VDI client, versions 5.14.14 and 5.15.12 are excluded from the affected range.
The weakness is CWE-266 (incorrect privilege assignment). The vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, so the attacker needs local access and a low privilege account. Zoom rates it High with a base score of 8.8, which matches the NVD record.
Fixed version: 5.16.10 for all listed products. If you embed the Meeting SDK or Video SDK in your own app, the fix reaches you only when you rebuild with the updated SDK.
How to check if you're exposed
On a Windows machine, open Zoom, click your profile picture, then About Zoom, and read the version. For many machines, read it from the installed programs list or your endpoint management tool.
wmic product where "name like 'Zoom%'" get name,version
If you ship software that bundles the Zoom Meeting or Video SDK for Windows, check the SDK version in your build files and release notes. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Inventory Zoom Desktop, VDI and SDK versions across Windows endpoints and virtual desktop images.
- Update to 5.16.10 or later using your normal software deployment. Update VDI base images and republish them.
- If your product embeds a Zoom SDK for Windows, move to a fixed SDK and ship a new build.
- Confirm that auto update is not blocked on shared or locked down machines.
- Limit local accounts on shared systems, since exploitation needs a local login.
Why it matters
Improper access control means a component grants more rights than its caller should have. A user with a basic account can reach high privilege actions, and the changed scope in the vector means the impact reaches beyond the Zoom component itself.
Local privilege escalation bugs rarely matter alone. They matter after another foothold, such as a stolen standard user login or a malicious program that runs without admin rights. Keeping clients current closes that second step. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes this?
Zoom lists 5.16.10 for the desktop client, the VDI client and both SDKs for Windows.
Can someone exploit it from the internet?
The vector is local. The attacker needs access to the machine with a low privilege account.
Sources
Last reviewed: 19 October 2026.
