CVE-2025-0150: Zoom Meeting SDK DOS Vulnerability

CVE-2025-0150 Overview

CVE-2025-0150 is a denial-of-service vulnerability in Zoom Workplace Apps for iOS versions prior to 6.3.0. The flaw stems from incorrect behavior order [CWE-696] in the application logic. An authenticated user with network access can trigger the condition to disrupt availability of the affected Zoom client. The vulnerability affects both the Zoom Workplace app and the Zoom Meeting Software Development Kit (SDK) on iOS. Zoom disclosed the issue in Zoom Security Bulletin ZSB-25009.

Critical Impact
An authenticated remote attacker can cause a denial-of-service condition against Zoom Workplace iOS clients, disrupting meetings and mobile collaboration workflows.

Affected Products

Zoom Workplace App for iOS (versions before 6.3.0)
Zoom Meeting SDK for iOS (versions before 6.3.0)
Applications embedding the vulnerable Zoom Meeting SDK on iPhone OS

Discovery Timeline

2025-03-11 - CVE-2025-0150 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0150

Vulnerability Analysis

The vulnerability is classified under CWE-696 (Incorrect Behavior Order). This weakness occurs when a product performs operations in a sequence that violates security assumptions. In the Zoom Workplace iOS client, certain operations execute out of their intended order when processing network-driven inputs. The result is a state the application cannot safely handle, leading to a denial-of-service condition.

Exploitation requires the attacker to be authenticated. The attack is delivered over the network without user interaction. Only availability is affected. Confidentiality and integrity remain intact according to the published CVSS vector.

Root Cause

The root cause is an ordering flaw in how the iOS client sequences internal operations during network communication. When specific conditions are met, the app processes actions in an order that leaves it in an inconsistent state. This inconsistency causes the client to become unresponsive or terminate.

Attack Vector

An authenticated attacker sends crafted traffic over the network to a target running a vulnerable Zoom Workplace iOS client or an app embedding the vulnerable Meeting SDK. The malformed sequence triggers the ordering flaw and disrupts the session. No user interaction on the victim device is required. Zoom has not published proof-of-concept exploit code, and no public exploit is currently available.

Specific packet structures and reproduction steps are not published in the vendor bulletin. Refer to Zoom Security Bulletin ZSB-25009 for vendor guidance.

Detection Methods for CVE-2025-0150

Indicators of Compromise

Unexpected crashes or hangs of the Zoom Workplace iOS app during active meetings or signaling
Repeated Zoom session terminations correlated with inbound traffic from a specific authenticated peer
Mobile device management (MDM) crash reports referencing the Zoom Workplace app version below 6.3.0

Detection Strategies

Inventory iOS devices via MDM to identify Zoom Workplace and Meeting SDK builds older than 6.3.0
Correlate mobile crash telemetry with meeting session logs to identify DoS patterns tied to specific participants
Monitor Zoom account activity for repeated join-and-disconnect behavior indicative of abuse attempts

Monitoring Recommendations

Enable centralized crash reporting from managed iOS fleets and alert on spikes tied to Zoom processes
Review Zoom admin dashboard for reports of abnormal meeting terminations affecting mobile users
Track Zoom client version compliance against the fixed 6.3.0 baseline on an ongoing basis

How to Mitigate CVE-2025-0150

Immediate Actions Required

Update all Zoom Workplace iOS clients to version 6.3.0 or later through the App Store or MDM
Rebuild and redistribute any in-house iOS applications that embed the Zoom Meeting SDK using SDK 6.3.0 or later
Enforce a minimum Zoom client version in Zoom admin settings to block outdated mobile clients from joining meetings

Patch Information

Zoom has released Zoom Workplace App for iOS version 6.3.0 and Zoom Meeting SDK for iOS version 6.3.0, which remediate CVE-2025-0150. Full remediation details are documented in Zoom Security Bulletin ZSB-25009. Organizations should prioritize deployment to all managed iOS devices used for Zoom meetings.

Workarounds

Restrict Zoom meetings to authenticated users from trusted domains to reduce the pool of potential attackers
Use waiting rooms and host-controlled admission to limit exposure of iOS participants to unknown attendees
Where feasible, direct mobile users to the desktop client until iOS clients are updated to 6.3.0

bash

# Example: enforce minimum Zoom iOS client version via MDM policy (pseudocode)
zoom_admin_policy:
  platform: ios
  minimum_client_version: "6.3.0"
  action_on_noncompliant: block_join