CVE-2025-30668: Zoom Meeting SDK DOS Vulnerability

CVE-2025-30668 Overview

CVE-2025-30668 is an integer underflow vulnerability [CWE-191] affecting multiple Zoom Workplace applications. An authenticated attacker with network access can trigger the flaw to cause a denial of service condition against the affected client. The issue impacts Zoom Workplace desktop clients, Zoom Rooms, Zoom Rooms Controller, the Meeting SDK, and Zoom Workplace VDI across Windows, macOS, Linux, Android, iOS, and iPadOS platforms. Zoom disclosed the vulnerability in security bulletin ZSB-25020 and released patches for the affected products.

Critical Impact
An authenticated network attacker can crash Zoom Workplace clients, disrupting meetings, collaboration sessions, and conference room operations that rely on Zoom services.

Affected Products

Zoom Meeting Software Development Kit (Android, Linux, macOS, Windows)
Zoom Rooms and Zoom Rooms Controller (Android, iPadOS, macOS, Windows, Linux)
Zoom Workplace, Workplace Desktop, and Workplace VDI (Windows, macOS, Linux, iOS)

Discovery Timeline

2025-05-14 - CVE-2025-30668 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30668

Vulnerability Analysis

The vulnerability is classified as an integer underflow [CWE-191], which occurs when an arithmetic operation produces a value smaller than the minimum representable value for the integer type. In the affected Zoom Workplace components, this condition can be triggered remotely by an authenticated user over the network. The result is an availability impact on the client process, terminating meeting sessions or making the application unresponsive. The attack requires low privileges and no user interaction, which broadens the pool of potential attackers to any authenticated meeting participant. Zoom has not publicly disclosed the specific protocol handler or component containing the flawed arithmetic operation.

Root Cause

Integer underflow occurs when a subtraction or decrement operation on an unsigned integer wraps around to a very large value, or when a signed integer drops below its minimum bound. In this case, the underflow likely occurs during parsing or length calculation of network-supplied data within a Zoom client component. The resulting corrupted value causes memory access errors or logic failures that crash the client. Missing bounds validation on untrusted input before arithmetic operations is the underlying weakness.

Attack Vector

Exploitation requires the attacker to be authenticated to a Zoom service and able to send crafted network traffic to the target client. The attacker sends a malformed message containing values that trigger the underflow condition during processing. Because the impact is limited to availability, the vulnerability does not permit code execution, data theft, or integrity modification. However, in enterprise environments that depend on Zoom Rooms for conference operations, the disruption potential is meaningful. See the Zoom Security Bulletin ZSB-25020 for vendor-supplied technical details.

Detection Methods for CVE-2025-30668

Indicators of Compromise

Unexpected Zoom client crashes or hangs coinciding with active meeting participation
Repeated Zoom Rooms Controller restarts or watchdog service triggers on conference room hardware
Application crash reports referencing memory access violations in Zoom client binaries
Meeting session terminations affecting a single participant while others remain connected

Detection Strategies

Monitor endpoint telemetry for abnormal termination of Zoom.exe, zoom (Linux), or Zoom Rooms processes
Correlate Windows Event Log Application crash entries with Zoom binaries and meeting session timestamps
Track version compliance of deployed Zoom Workplace clients against the patched versions listed in ZSB-25020
Establish a baseline for expected Zoom process behavior and alert on statistically significant crash frequency increases

Monitoring Recommendations

Ingest Zoom client crash logs and endpoint process telemetry into your SIEM for correlation
Alert on multiple crashes of Zoom processes across distinct endpoints within a short time window, indicating possible targeted disruption
Review authentication logs on Zoom tenant admin portals for suspicious meeting join patterns preceding client crashes

How to Mitigate CVE-2025-30668

Immediate Actions Required

Inventory all Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, Meeting SDK, and Workplace VDI installations across managed endpoints
Update all affected Zoom clients to the fixed versions specified in Zoom Security Bulletin ZSB-25020
Prioritize patching of Zoom Rooms hardware and shared conference room devices, which typically lag behind desktop client update cycles
Verify Meeting SDK-based internal applications are rebuilt against the patched SDK version

Patch Information

Zoom has released updated versions of the affected Workplace applications that remediate the integer underflow condition. Refer to Zoom Security Bulletin ZSB-25020 for the specific fixed versions per product and platform. Deploy patches through your standard software distribution mechanism, and enable automatic updates in Zoom client policy where operationally feasible.

Workarounds

No official workaround exists; patching is the only supported remediation path
Restrict meeting participation to trusted, authenticated attendees using waiting rooms and registration requirements to reduce exposure
Enable Zoom client auto-update policies through the Zoom admin portal to accelerate future patch deployment
Segment Zoom Rooms devices onto isolated network segments with restricted inbound access from untrusted meeting participants

bash

# Verify installed Zoom client version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX" /v DisplayVersion

# Verify installed Zoom client version on macOS
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString

# Verify installed Zoom client version on Linux
zoom --version