CVE-2025-30670: Zoom Meeting SDK DOS Vulnerability

CVE-2025-30670 Overview

CVE-2025-30670 is a null pointer dereference vulnerability [CWE-476] affecting multiple Zoom Workplace Apps for Windows. An authenticated user with network access can trigger the dereference remotely to cause a denial of service against the targeted Zoom application. The flaw does not permit code execution or data disclosure, but it does disrupt availability of affected Zoom clients and endpoints.

Zoom disclosed the issue in security bulletin ZSB-25015 and the CVE was published to the National Vulnerability Database (NVD) on April 8, 2025.

Critical Impact
An authenticated remote attacker can crash Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, Zoom VDI, and Zoom Meeting SDK sessions on Windows, interrupting meetings and collaboration workflows.

Affected Products

Zoom Workplace Desktop for Windows
Zoom Rooms and Zoom Rooms Controller for Windows
Zoom Workplace Virtual Desktop Infrastructure (VDI) and Zoom Meeting SDK for Windows

Discovery Timeline

2025-04-08 - CVE-2025-30670 published to NVD and disclosed in Zoom Security Bulletin ZSB-25015
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30670

Vulnerability Analysis

The flaw is a null pointer dereference inside Zoom Workplace Apps for Windows. When the vulnerable code path receives specific input over the network from an authenticated user, it accesses a pointer without validating that it references a live object. The dereference triggers an access violation and terminates the Zoom process. The impact is limited to availability: confidentiality and integrity are not affected.

Because the attack vector is network-based and requires only low privileges with no user interaction, an attacker inside a meeting or with authenticated access to Zoom services can repeatedly disrupt sessions. The condition can affect meeting participants, Zoom Rooms deployments, and virtualized Zoom clients across enterprise environments.

Root Cause

The vulnerability stems from missing validation of a pointer before it is read or written. Classified under [CWE-476], the defect occurs when the application assumes an object or buffer has been successfully allocated or initialized and dereferences the pointer without a null check. Any crafted message that causes the application to reach that code path with an uninitialized or freed reference produces the crash.

Attack Vector

Exploitation requires network reachability to the Zoom client and an authenticated session. The attacker sends a crafted request or protocol message that drives the Zoom process down the vulnerable code path. The targeted application process crashes immediately. No sample exploit code, public proof-of-concept, or in-the-wild exploitation has been reported. See Zoom Security Bulletin ZSB-25015 for vendor technical details.

Detection Methods for CVE-2025-30670

Indicators of Compromise

Unexpected termination of Zoom.exe, ZoomRooms.exe, or Zoom VDI plugin processes during active sessions.
Windows Application event log entries recording access violations (0xC0000005) in Zoom Workplace binaries.
Repeated Watson or Windows Error Reporting (WER) crash dumps generated for Zoom processes on the same host.

Detection Strategies

Correlate Zoom client crashes with inbound session activity from a single authenticated identity across multiple endpoints.
Inventory Zoom Workplace, Rooms, Rooms Controller, VDI, and Meeting SDK versions and flag hosts running builds below those listed in ZSB-25015.
Monitor for abnormal frequency of Zoom process restarts across managed Windows endpoints over short time windows.

Monitoring Recommendations

Forward Windows Application and WER crash telemetry to a centralized SIEM or data lake for correlation across the Zoom fleet.
Alert on repeated meeting disconnects tied to the same meeting ID or participant, which may indicate deliberate crash attempts.
Track installed Zoom client versions through endpoint management tooling and flag drift from the patched baseline.

How to Mitigate CVE-2025-30670

Immediate Actions Required

Update all Windows installations of Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, Zoom VDI, and Zoom Meeting SDK to the fixed versions listed in ZSB-25015.
Enforce automatic updates for Zoom clients across managed endpoints to reduce exposure windows.
Restrict meeting access using waiting rooms, authentication requirements, and passcodes to limit the pool of users who can reach vulnerable code paths.

Patch Information

Zoom addressed CVE-2025-30670 in the versions published in security bulletin ZSB-25015 on April 8, 2025. Refer to the Zoom Security Bulletin ZSB-25015 for the authoritative list of fixed client versions for each affected product.

Workarounds

No vendor-supplied workaround is available; patching is the only supported remediation.
Limit Zoom meeting participation to authenticated internal users where business requirements allow.
Use application allowlisting and endpoint management policies to block execution of outdated Zoom installers that reintroduce vulnerable versions.

bash

# Query installed Zoom client version on Windows endpoints
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX" /v DisplayVersion