CVE-2025-0144: Zoom Meeting SDK Privilege Escalation Flaw

CVE-2025-0144 Overview

CVE-2025-0144 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Zoom Workplace applications and SDKs across Windows, macOS, Linux, Android, iOS, and iPadOS. The flaw allows an authenticated user with network access to trigger a write outside the bounds of an allocated buffer, resulting in a loss of integrity in the affected process. Zoom disclosed the issue in security bulletin ZSB-25003. The vulnerability affects Zoom Workplace clients, Zoom Rooms, Rooms Controller, the Meeting SDK, the Video SDK, and Zoom Workplace VDI builds prior to the fixed versions.

Critical Impact
An authorized remote user can corrupt memory in Zoom Workplace Apps, compromising the integrity of the affected client process.

Affected Products

Zoom Workplace and Zoom Workplace Desktop (Windows, macOS, Linux, Android, iOS)
Zoom Rooms and Zoom Rooms Controller (Windows, macOS, Linux, Android, iPadOS)
Zoom Meeting SDK, Zoom Video SDK, and Zoom Workplace VDI (Windows)

Discovery Timeline

2025-01-30 - CVE-2025-0144 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0144

Vulnerability Analysis

The issue is an out-of-bounds write in components shared across the Zoom Workplace product line. An authenticated attacker sends crafted network input processed by a vulnerable Zoom component. The component writes beyond the allocated buffer boundary, corrupting adjacent memory. The resulting corruption compromises integrity of application state but does not directly expose data confidentiality or halt availability, based on the published impact profile. Because the vulnerable code is shared across desktop clients, mobile clients, Rooms infrastructure, and the developer SDKs, the surface spans nearly every deployment mode of Zoom.

Root Cause

The root cause is missing or incorrect bounds validation prior to a memory write operation, classified as [CWE-787] Out-of-bounds Write. When the vulnerable code path processes attacker-influenced input, the calculated write index or length exceeds the target buffer capacity. The write then overwrites adjacent structures in memory used by the Zoom client process.

Attack Vector

Exploitation requires network access and valid authentication to a Zoom session or service. No user interaction is required beyond normal session participation. An attacker joins or connects to a Zoom session and transmits malformed protocol data that reaches the vulnerable parsing or handling routine on a target participant or service. Because scope is unchanged, the impact remains confined to the vulnerable Zoom process context.

Zoom has not released technical exploitation details. Refer to Zoom Security Bulletin ZSB-25003 for vendor guidance. No public proof-of-concept or in-the-wild exploitation has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-0144

Indicators of Compromise

Unexpected crashes, hangs, or restarts of Zoom client processes (Zoom.exe, zoom, ZoomRooms) coinciding with active meetings or SDK sessions.
Windows Error Reporting (WER) or macOS crash reports referencing access violations inside Zoom modules.
Anomalous outbound or peer-to-peer traffic to Zoom endpoints from hosts running outdated client versions.

Detection Strategies

Inventory installed Zoom Workplace, Rooms, and SDK versions across managed endpoints and flag builds predating the ZSB-25003 fixed releases.
Correlate Zoom process crashes with meeting session identifiers and originating participants to identify suspicious triggers.
Monitor for unauthorized installation of Zoom SDK-based applications that could embed the vulnerable component.

Monitoring Recommendations

Ingest endpoint telemetry (process crashes, module load events, network connections) into a centralized analytics platform for correlation.
Alert on Zoom client versions falling behind the vendor's published fixed release.
Track advisories at Zoom Trust Center for related follow-up CVEs affecting shared components.

How to Mitigate CVE-2025-0144

Immediate Actions Required

Update all Zoom Workplace, Zoom Workplace Desktop, Zoom Rooms, Rooms Controller, Meeting SDK, Video SDK, and Workplace VDI installations to the fixed versions listed in ZSB-25003.
Enforce automatic updates for Zoom clients through MDM, Intune, Jamf, or Group Policy to prevent version drift.
Audit third-party applications built on the Zoom Meeting or Video SDK and require developers to rebuild against patched SDK releases.

Patch Information

Zoom released fixes across the affected product families. Consult Zoom Security Bulletin ZSB-25003 for the specific minimum fixed versions per product and platform. Deploy the patched builds to all Windows, macOS, Linux, Android, iOS, and iPadOS endpoints running Zoom software.

Workarounds

No official workaround has been published by Zoom; patching is the required remediation.
Restrict Zoom meeting participation to authenticated, trusted users and enable waiting rooms to limit exposure to untrusted authenticated attackers.
Decommission or isolate legacy Zoom Rooms hardware that cannot receive the patched firmware or client build.

bash

# Example: query installed Zoom version on Windows endpoints via PowerShell
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Zoom*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation