LiveActive security incident?Get immediate response
CVE Record

CVE-2019-13567: The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than...

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This issue affects older Zoom for macOS installations where the hidden ZoomOpener service remains running. A malicious launch URL could cause remote code execution when the Zoom client is missing or cannot open. The bundle does not prove active exploitation.

Executive priority

Treat this as a targeted macOS endpoint cleanup priority, especially for executive, sales, and remote-work fleets. The business concern is unauthorized code execution through a leftover helper service, but urgency depends on whether vulnerable ZoomOpener remnants remain.

Technical view

CVE-2019-13567 is a macOS Zoom Client issue before 4.4.53932.0709 involving the ZoomOpener daemon, also described as a hidden web server. If that daemon is running and the Zoom Client is absent or unavailable, a crafted launch URL can trigger code execution.

Likely exposure

Exposure is limited to macOS systems with Zoom Client before 4.4.53932.0709 or lingering ZoomOpener components. Risk is higher on unmanaged Macs or systems where Apple MRT is disabled, outdated, or not confirmed to have the 2019-07-10 MRTConfigData.

Exploitation context

The sources describe remote code execution through a crafted launch URL and include public discussion. CISA KEV is false in the bundle, and no cited source here confirms active exploitation in the wild.

Researcher notes

Evidence is strongest for affected conditions and version threshold. The provided bundle lacks CVSS, CWE, detailed vendor fix notes, and confirmed exploitation. Do not merge this with CVE-2019-13450; the description explicitly says it is different.

Mitigation direction

  • Update Zoom for macOS beyond 4.4.53932.0709 using Zoom guidance.
  • Ensure Apple MRT is enabled and has 2019-07-10 MRTConfigData or later.
  • Confirm ZoomOpener is removed or no longer running on managed macOS devices.
  • Check vendor and Apple guidance before manually removing components.
  • Prioritize unmanaged or legacy macOS endpoint cleanup.

Validation and detection

  • Inventory macOS devices with Zoom installed or formerly installed.
  • Verify installed Zoom Client versions are not before 4.4.53932.0709.
  • Confirm the ZoomOpener daemon is absent or inactive.
  • Confirm Apple MRT updates reached affected macOS endpoints.
  • Review endpoint telemetry for suspicious Zoom launch URL handling.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-13567 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
8Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.