An issue was discovered in Zalo.exe in VNG Zalo Desktop 19.8.1.0. An attacker can run arbitrary commands on a remote Windows machine running the Zalo client by sending the user of the device a crafted file.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16087
Reference (s):
- https://github.com/VNG-Zalo
- https://threatspike.com
- https://www.threatspike.com/blog/cve-2020-16087.html