CVE-2025-0151 Overview
CVE-2025-0151 is a use-after-free vulnerability [CWE-416] affecting multiple Zoom Workplace applications. The flaw allows an authenticated user to conduct privilege escalation through network access. Zoom disclosed the issue in security bulletin ZSB-25010 and assigned a CVSS 3.1 base score of 8.8.
The vulnerability affects Zoom Workplace desktop and mobile clients, Zoom Rooms, Zoom Rooms Controller, the Meeting SDK, and the Workplace VDI client across Windows, macOS, Linux, Android, and iOS. Successful exploitation can lead to compromise of confidentiality, integrity, and availability on affected hosts.
Critical Impact
An authenticated attacker with low privileges can trigger memory corruption over the network to escalate privileges, gaining the ability to execute code in the context of the Zoom client process.
Affected Products
- Zoom Workplace (Android, iOS) and Zoom Workplace Desktop (Windows, macOS, Linux)
- Zoom Rooms and Zoom Rooms Controller (Windows, macOS, Linux, Android, iPadOS)
- Zoom Meeting SDK (Windows, macOS, Linux, Android, iOS) and Zoom Workplace VDI for Windows
Discovery Timeline
- 2025-03-11 - CVE-2025-0151 published to NVD
- 2025-10-22 - Last updated in NVD database
Technical Details for CVE-2025-0151
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] within Zoom Workplace application components. A use-after-free occurs when a program continues to reference memory after it has been released back to the allocator. An attacker who can influence object lifetime and reallocation can place attacker-controlled data into the freed region.
The CVSS vector indicates the issue is reachable over the network with low attack complexity. The attacker must hold valid credentials or an authenticated session, such as a meeting participant context. No user interaction is required once the attacker reaches the vulnerable code path. Successful exploitation impacts confidentiality, integrity, and availability of the host running the client.
Root Cause
The defect stems from improper management of object lifetime within Zoom Workplace client code. A reference to a heap object persists after the allocator reclaims the underlying memory. Subsequent operations dereference the dangling pointer, allowing the attacker to redirect execution flow or corrupt adjacent structures. Zoom has not published implementation-level detail beyond the advisory in ZSB-25010.
Attack Vector
Exploitation requires network access and an authenticated session against the Zoom application. The attacker delivers crafted protocol messages or meeting payloads that cause the client to access freed memory. Because the client runs with the privileges of the signed-in user and interacts with system APIs for audio, video, and screen capture, code execution within the client process can be leveraged for privilege escalation on the host.
No verified proof-of-concept code is publicly available. See the Zoom Security Bulletin ZSB-25010 for vendor guidance.
Detection Methods for CVE-2025-0151
Indicators of Compromise
- Unexpected crashes, exception logs, or watchdog restarts of Zoom client processes such as Zoom.exe, CptHost.exe, or zoom on Linux.
- Zoom client processes spawning unusual child processes, command interpreters, or scripting engines after meeting activity.
- Outbound network connections from Zoom client processes to non-Zoom infrastructure during or immediately after a session.
Detection Strategies
- Inventory installed Zoom Workplace, Rooms, Rooms Controller, Meeting SDK, and VDI client versions and flag builds released before the fix referenced in ZSB-25010.
- Hunt for memory-corruption artifacts in Windows Error Reporting, macOS crash logs, and Linux core dumps tied to Zoom binaries.
- Correlate authenticated Zoom session telemetry with endpoint behavioral alerts on Zoom processes to identify exploitation attempts.
Monitoring Recommendations
- Alert on child-process creation chains originating from Zoom executables, particularly shells, rundll32, regsvr32, or osascript.
- Monitor file-system writes by Zoom processes outside their normal application data directories.
- Track network egress from Zoom client processes that does not resolve to Zoom-owned domains or expected meeting infrastructure.
How to Mitigate CVE-2025-0151
Immediate Actions Required
- Update all Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, Meeting SDK, and Workplace VDI installations to the versions listed as fixed in ZSB-25010.
- Prioritize patching on systems used by privileged users, executives, and shared conference-room hardware.
- Audit managed device fleets for outdated Zoom installers and remove unmanaged or sideloaded copies.
Patch Information
Zoom released fixed versions for all affected Workplace components. Refer to the Zoom Security Bulletin ZSB-25010 for the authoritative list of fixed builds across Windows, macOS, Linux, Android, iOS, and iPadOS. Apply patches through Zoom's auto-update mechanism or enterprise software distribution channels.
Workarounds
- No vendor-supplied workaround exists; patching to the fixed release is the only remediation.
- Restrict Zoom client usage to authenticated, trusted meetings until patches are deployed across the fleet.
- Enforce application allowlisting and behavioral controls on endpoints to constrain post-exploitation activity from the Zoom process.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
