CVE-2023-36540: 
NixOS vulnerability analysis and mitigation

CVE-2023-36540 is a security vulnerability affecting the Zoom Desktop Client for Windows before version 5.14.5. The vulnerability was discovered and disclosed in August 2023, involving an untrusted search path in the installer that could potentially lead to privilege escalation. The vulnerability affects Windows-based Zoom client installations (NVD).

The vulnerability is classified as an untrusted search path issue (CWE-426) in the Zoom Desktop Client installer for Windows. It received a CVSS v3.1 base score of 7.8 (High) from NIST with a vector string of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Zoom assigned it a slightly lower score of 7.3 (High) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L (NVD).

The vulnerability could allow an authenticated user with local access to escalate privileges on the affected system. This could potentially lead to unauthorized access to system resources and compromise of system security (Rapid7).

Users are advised to update their Zoom Desktop Client for Windows to version 5.14.5 or later to address this vulnerability. This update patches the untrusted search path issue in the installer (Security Online).