CVE-2024-24697: 
NixOS vulnerability analysis and mitigation

CVE-2024-24697 is a high-severity vulnerability affecting Zoom 32-bit Windows clients. The vulnerability was discovered and reported by sim0nsecurity and was officially disclosed on February 13, 2024. This security flaw involves an untrusted search path that could potentially allow authenticated users to escalate their privileges through local access (Zoom Bulletin).

The vulnerability has been assigned a CVSS score of 7.2 (High) with a vector string of CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. This indicates that the vulnerability requires local access, high complexity, high privileges, and user interaction to exploit, but could potentially result in high impacts to confidentiality, integrity, and availability (Zoom Bulletin).

If successfully exploited, this vulnerability could allow an authenticated user to conduct privilege escalation on affected systems. The scope of impact is specifically limited to 32-bit Windows clients, but could potentially lead to unauthorized access to system resources and elevated privileges (NVD).

Zoom has released patches to address this vulnerability. Users should update to Zoom Desktop Client for Windows version 5.17.0 or later, Zoom VDI Client for Windows version 5.17.5 or later (excluding 5.15.15 and 5.16.12), Zoom Meeting SDK for Windows version 5.17.0 or later, and Zoom Rooms Client for Windows version 5.17.0 or later (Zoom Bulletin).