Race Condition in Zscaler Client Connector Can Cause Heap Corruption

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC process.

The CNA identifies Zscaler Client Connector on Windows as affected, with a default status of unaffected outside the listed ranges:

• Branch 4.6: affected when the version is less than 4.6.0.486.
• Branch 4.7: affected when the version is less than 4.7.0.350.
• Branch 4.8: affected when the version is less than 4.8.0.267.
• Branch 4.9: affected when the version is less than 4.9.0.412.

The record does not establish impact for branches or platforms that are not listed. The status of parallel release branches should not be inferred from the update boundary for another branch.

The flaw is a race condition classified as CWE-366 in the ZPA tunnel handler of Zscaler Client Connector on Windows. Unsafe concurrent processing in this component can lead to heap corruption. The record states that the corruption can crash the client and may allow arbitrary code execution in the context of the ZCC process. The described attack path is network reachable, requires no authentication or user interaction, and has high attack complexity, indicating timing-dependent or otherwise difficult triggering conditions. The record does not disclose the relevant field, protocol message, synchronization detail, or race window, so the precise attacker-controlled input and exploit sequence remain unknown.

The vulnerability can be reached over the network, with no prior privileges and no user interaction required. Attack complexity is assessed as high, indicating that triggering the race condition may depend on difficult timing or execution conditions. The current status records exploitation as none and automatable as no, and the record does not identify a public exploit. These statuses do not prove exploitation is impossible and do not exclude a change in status as more information becomes available.

The race condition can produce heap corruption in the ZPA tunnel handler. The confirmed outcome is denial of service through a client crash; arbitrary code execution is described only as a potential outcome. If realized, execution would occur in the ZCC process context and could affect endpoint confidentiality, integrity, and availability within the privileges and data accessible to that process. The supplied vector indicates unchanged scope and no required privileges or user interaction, but high complexity makes triggering conditional. The record does not establish automatic spread to other endpoints or privilege elevation beyond the ZCC process context.

• Service disruption: Heap corruption can crash Zscaler Client Connector and may interrupt ZPA connectivity or application access on an affected endpoint.
• Endpoint control risk: If the potential code-execution outcome is realized, code could run in the ZCC process context and affect endpoint confidentiality, integrity, or availability according to the process's accessible privileges and data.
• Operational scope: The issue affects installations in the listed Windows release branches, while the CNA records the default status outside those ranges as unaffected.
• The record does not identify a breach, a specific victim, or a campaign using the vulnerability.

1. Update by release branch: move installations in branch 4.6 that are below 4.6.0.486 to 4.6.0.486; branch 4.7 installations below 4.7.0.350 to 4.7.0.350; branch 4.8 installations below 4.8.0.267 to 4.8.0.267; and branch 4.9 installations below 4.9.0.412 to 4.9.0.412.
2. Prioritize Windows endpoints that use ZPA and verify that the update has reached the complete inventory rather than only a sample of devices.
3. After rollout, re-check the installed version on endpoints and continue reviewing Client Connector crashes or ZPA interruptions for devices that were missed or remain unstable.
4. If an update cannot be deployed immediately, contact Zscaler for a supported temporary mitigation. The record does not provide a confirmed mitigation, so disabling a function should not be presented as a verified fix.

1. Inventory Windows endpoints running Zscaler Client Connector, including the installed version, release branch, and deployment status.
2. Compare installed versions with the branch-specific boundaries in affected_summary and remediation. Do not treat use of an unlisted branch as proof of safety unless that branch has been separately verified.
3. Review crash telemetry, restart records, and ZPA connectivity interruptions for Zscaler Client Connector, especially events occurring while the ZPA tunnel is being handled.
4. Treat client crashes or tunnel loss as investigation triggers, not as confirmed indicators of exploitation. The record does not provide a specific log event, file, process argument, or IOC that can confirm exploitation.