Description

A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-24T14:16:55.940Z",
  "pubdate": "2026-08-24T14:16:55.940Z",
  "executiveSummary": "This vulnerability is classified as a buffer overflow bug affecting Zscaler Client Connector on Android and ChromeOS platforms. The primary security impact of this vulnerability is a local denial-of-service attack against the affected system. The risk implication is localized service instability or application crashes, potentially disrupting security posture and secure connectivity management provided by the client connector. To successfully execute this attack, an adversary requires local execution capabilities on the target device. The vulnerability manifests locally, meaning remote network exploitation vectors are not inherently required, and the attacker leverages local access to supply malformed input or trigger memory corruption within the vulnerable component.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient boundary checking and memory management within Zscaler Client Connector running on Android and ChromeOS. When the application processes locally supplied input or internal data structures without properly validating the size of the data relative to the allocated buffer memory, a buffer overflow condition occurs. This memory corruption allows overwriting of adjacent stack or heap memory regions, depending on the architecture of the vulnerable component. Exploitation occurs when a locally executed payload or input stream exceeds the expected length limits, corrupting critical execution flow or causing unhandled exceptions that terminate the application process. Attack flow involves the local actor interacting with the vulnerable application or supplying malicious inputs locally, which the software processes unsafely. The vulnerable component fails to enforce strict input sanitization, leading directly to the anomalous memory state. Because the vulnerability is locally exploitable, network exposure is restricted, and exploitation typically relies on local code execution primitives or application-level interactions available to a local user or interacting process on the device. Post-exploitation impact is constrained by the local denial-of-service nature of the bug, resulting in service termination, application crashes, and temporary loss of client functionality rather than immediate arbitrary code execution or remote system compromise, though local instability remains a primary concern for endpoint reliability."
}