CVE-2021-28133

Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.

• CWE-200

• http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Mar/48Third Party Advisory
• https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.htmlThird Party Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txtThird Party Advisory
• https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133Third Party Advisory
• https://www.youtube.com/watch?v=SonmmgQlLzgThird Party Advisory
• https://zoom.us/trust/security/security-bulletinVendor Advisory
• http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.htmlThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Mar/48Third Party Advisory
• https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.htmlThird Party Advisory
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txtThird Party Advisory
• https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133Third Party Advisory
• https://www.youtube.com/watch?v=SonmmgQlLzgThird Party Advisory
• https://zoom.us/trust/security/security-bulletinVendor Advisory

Published

Mar 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-28127An issue was discovered in Stormshield SNS through 4.2.1. A …7.5
• CVE-2021-28128In Strapi through 3.6.0, the admin panel allows the changing…8.1
• CVE-2021-28129While working on Apache OpenOffice 4.1.8 a developer discove…7.8
• CVE-2021-28130Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts…7.8
• CVE-2021-28131Impala sessions use a 16 byte secret to verify that the sess…7.5
• CVE-2021-28132LUCY Security Awareness Software through 4.7.x allows unauth…9.8
• CVE-2021-28134Clipper before 1.0.5 allows remote command execution. A remo…9.8
• CVE-2021-28135The Bluetooth Classic implementation in Espressif ESP-IDF 4.…6.5
• CVE-2021-28136The Bluetooth Classic implementation in Espressif ESP-IDF 4.…6.5
• CVE-2021-28139The Bluetooth Classic implementation in Espressif ESP-IDF 4.…8.8
• CVE-2021-28141An issue was discovered in Progress Telerik UI for ASP.NET A…9.8
• CVE-2021-28142CITSmart before 9.1.2.28 mishandles the "filtro de autocompl…8.8