Executive brief
Cisco RoomOS, the operating system for Cisco collaboration and video conferencing devices, is affected by memory safety vulnerabilities. An attacker could potentially exploit these flaws to gain unauthorized access, disrupt video conferencing services, or compromise the integrity of the device. Cisco has released software updates to address these issues, which were discovered during internal security reviews.
Technical details
This advisory addresses a cluster of vulnerabilities categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), including buffer overflows and out-of-bounds writes. The vulnerabilities exist within Cisco RoomOS and can be triggered over the network. While the attack complexity is rated as high, a successful exploit could allow an unauthenticated remote attacker to achieve full compromise of confidentiality, integrity, and availability (RCE). The issues were discovered internally by Cisco using security testing processes and AI models. Fixed releases include RoomOS 11.32.6.0 (on-premises), 11.39.1.1 (cloud-aware), and 26.5.2.2.
Affected products
- Cisco RoomOS Software 11 and earlier; 26 before 26.5.2.2
Timeline
- 2026-07-15: advisory: Initial public release by Cisco
- 2026-07-15: patched