CVE-2025-27441: Zoom Meeting SDK XSS Vulnerability

CVE-2025-27441 Overview

CVE-2025-27441 is a cross-site scripting (XSS) vulnerability affecting multiple Zoom Workplace applications. The flaw allows an unauthenticated attacker with adjacent network access to inject script content that can compromise the integrity of the targeted client. Exploitation requires user interaction, and the scope is changed, meaning impact can extend beyond the vulnerable component.

Zoom assigned this issue to security bulletin ZSB-25013. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-352 (Cross-Site Request Forgery).

Critical Impact
An unauthenticated attacker on an adjacent network can execute script content in a victim's Zoom client, producing limited loss of confidentiality and integrity after user interaction.

Affected Products

Zoom Workplace and Zoom Workplace Desktop (Windows, macOS, Linux, Android, iOS)
Zoom Rooms and Zoom Rooms Controller (Windows, macOS, Android, Linux, iPadOS)
Zoom Meeting Software Development Kit and Zoom Workplace VDI (Windows)

Discovery Timeline

2025-04-08 - CVE-2025-27441 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-27441

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw within Zoom Workplace client components. An attacker positioned on an adjacent network can deliver crafted input that the client renders without proper neutralization. When a user interacts with the malicious content, the embedded script executes in the context of the Zoom application.

Because the CVSS scope is changed, successful exploitation can affect resources beyond the immediate vulnerable component. The advisory also references CWE-352, indicating that cross-site request forgery characteristics may be chained with the XSS to perform actions on behalf of the victim. The result is limited loss of integrity and confidentiality without availability impact.

Root Cause

The root cause is improper neutralization of user-controlled input rendered by Zoom Workplace client surfaces. Input that should be treated as data is interpreted as executable script, allowing arbitrary HTML or JavaScript to run within the client's rendering context. Insufficient request validation contributes to the CSRF component identified in the advisory.

Attack Vector

Exploitation requires adjacent network access, which limits attacks to the same broadcast domain, local subnet, or shared collaboration session. No authentication is required, but the victim must perform an action such as clicking a link or accepting content for the payload to trigger. After execution, the attacker can manipulate client state, alter rendered content, or trigger forged requests within the victim's authenticated context.

No public proof-of-concept code has been published. Refer to the Zoom Security Bulletin ZSB-25013 for vendor-supplied technical detail.

Detection Methods for CVE-2025-27441

Indicators of Compromise

Zoom client versions running below the fixed releases listed in ZSB-25013 on Windows, macOS, Linux, Android, or iOS endpoints.
Unexpected outbound HTTP/HTTPS connections originating from Zoom client processes immediately after meeting or chat interaction.
Anomalous child processes or scripting activity spawned by Zoom Workplace, Zoom Rooms, or Zoom Rooms Controller binaries.

Detection Strategies

Inventory all installed Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, and Meeting SDK builds and compare versions against those fixed in ZSB-25013.
Hunt for Zoom client telemetry showing rendering of unusual URLs, chat payloads, or shared content from untrusted adjacent-network participants.
Correlate Zoom process activity with network telemetry to surface connections to attacker-controlled hosts following meeting joins.

Monitoring Recommendations

Enable endpoint logging for Zoom binaries and forward to a central analytics platform to detect anomalous script execution patterns.
Monitor for Zoom client updates and alert when endpoints remain on vulnerable versions beyond a defined remediation window.
Track adjacent-network meeting joins from untrusted Wi-Fi or guest networks where exploitation conditions are easier to meet.

How to Mitigate CVE-2025-27441

Immediate Actions Required

Update all Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, Meeting SDK, and Workplace VDI installations to the fixed versions identified in Zoom Security Bulletin ZSB-25013.
Prioritize patching for endpoints that routinely join meetings on untrusted or guest networks.
Validate that auto-update is enabled and functioning across managed Zoom deployments.

Patch Information

Zoom published fixed releases through security bulletin ZSB-25013. Administrators should consult the bulletin for exact fixed version numbers for each affected platform and component, then deploy the updates through their managed software distribution tooling.

Workarounds

Restrict Zoom client usage on adjacent networks shared with untrusted devices, such as open guest Wi-Fi.
Educate users to avoid interacting with unexpected links, shared content, or chat payloads from unknown meeting participants.
Segment conference room and Zoom Rooms devices onto dedicated VLANs to reduce adjacent-network exposure.

bash

# Configuration example: verify installed Zoom version on Windows
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Zoom*" } |
  Select-Object DisplayName, DisplayVersion