CVE-2025-30662 Overview
CVE-2025-30662 is a symlink following vulnerability [CWE-646] in the Zoom Workplace Virtual Desktop Infrastructure (VDI) Plugin macOS Universal installer. The installer follows symbolic links during its execution, which an authenticated local user can abuse to disclose sensitive information. Zoom addressed the issue in versions 6.3.14, 6.4.14, and 6.5.10 across the respective release tracks. The vulnerability affects installations of the macOS Universal installer prior to those fixed versions.
Critical Impact
An authenticated user can exploit symlink following in the installer to gain unauthorized read access to sensitive files on macOS hosts running vulnerable versions of the Zoom Workplace VDI Plugin.
Affected Products
- Zoom Workplace VDI Plugin for macOS Universal installer before 6.3.14
- Zoom Workplace VDI Plugin for macOS Universal installer before 6.4.14
- Zoom Workplace VDI Plugin for macOS Universal installer before 6.5.10
Discovery Timeline
- 2025-11-13 - CVE-2025-30662 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30662
Vulnerability Analysis
The Zoom Workplace VDI Plugin macOS Universal installer performs file operations without validating whether target paths are symbolic links. When the installer processes files during installation, it follows symlinks placed by a local attacker, redirecting privileged read operations to attacker-chosen locations. This behavior enables an authenticated user to trigger disclosure of file contents that would otherwise be inaccessible. The issue is classified under [CWE-646] Reliance on File Name or Extension of Externally-Supplied File.
Root Cause
The installer does not check the link status of files it operates on before performing read or copy actions. macOS supports symbolic links that transparently redirect file system access, so an installer running with elevated privileges dereferences attacker-placed links to protected file paths. The absence of lstat or equivalent checks and the missing use of O_NOFOLLOW semantics allow the redirection to succeed silently.
Attack Vector
An authenticated user prepares symbolic links in directories used by the installer before or during the installation process. When the installer runs, it follows these links and exposes file contents through installer logs, temporary files, or output artifacts accessible to the attacker. Although the CVE metadata records the attack vector as network with user interaction required, exploitation depends on tricking the installer running on the target macOS host into following attacker-controlled links. No integrity or availability impact is expected; the outcome is limited to confidentiality loss.
No public proof-of-concept exploit code is available. The vulnerability mechanism is described in the Zoom Security Bulletin ZSB-25045.
Detection Methods for CVE-2025-30662
Indicators of Compromise
- Unexpected symbolic links present in installer working directories or temporary paths used by the Zoom Workplace VDI Plugin installer.
- Installer log entries or output files containing contents of unrelated system files such as /etc/, /var/db/, or user home directories.
- Zoom VDI Plugin installer executions initiated by non-administrative user sessions on macOS endpoints.
Detection Strategies
- Monitor macOS Endpoint Security Framework events for symlink creation immediately preceding execution of the Zoom VDI Plugin installer binary.
- Alert on installer processes performing open() calls that resolve through symbolic links owned by non-privileged users.
- Track version telemetry for Zoom Workplace VDI Plugin and flag hosts running versions earlier than 6.3.14, 6.4.14, or 6.5.10.
Monitoring Recommendations
- Enable file integrity monitoring on installer staging directories and installer log paths on macOS endpoints.
- Collect and centralize installer execution logs and correlate them with process ancestry to identify unauthorized installer invocations.
- Audit software inventory reports to confirm all Zoom Workplace VDI Plugin instances are on patched builds.
How to Mitigate CVE-2025-30662
Immediate Actions Required
- Upgrade the Zoom Workplace VDI Plugin for macOS to version 6.3.14, 6.4.14, or 6.5.10 or later depending on the release track in use.
- Restrict installer execution to administrative accounts and prevent standard users from invoking the installer directly.
- Review recent installer execution logs on macOS endpoints for evidence of unexpected symlink resolution.
Patch Information
Zoom released fixed versions on the tracks affected by this issue. Refer to the Zoom Security Bulletin ZSB-25045 for the authoritative list of fixed versions and download locations. Upgrade to 6.3.14, 6.4.14, or 6.5.10 or later as appropriate for your deployment.
Workarounds
- Restrict write access to installer staging directories so that only trusted administrators can place files there.
- Run the installer only from clean, controlled directories to reduce the likelihood of attacker-placed symbolic links being present.
- Remove or quarantine older installer binaries from managed macOS endpoints to prevent inadvertent execution of vulnerable versions.
# Verify installed Zoom Workplace VDI Plugin version on macOS
mdls -name kMDItemVersion "/Applications/ZoomVDIPlugin.app" 2>/dev/null
# Enumerate symbolic links in a directory before running an installer
find /path/to/installer/working/dir -type l -ls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
