CVE-2025-58135: Zoom Meeting SDK Information Disclosure

CVE-2025-58135 Overview

CVE-2025-58135 affects certain Zoom Workplace Clients for Windows. The vulnerability stems from improper action enforcement, categorized under [CWE-837] Improper Enforcement of a Single, Unique Action. An unauthenticated attacker can exploit this weakness over the network to disclose sensitive information from the client. Exploitation requires user interaction, which limits attack automation but does not eliminate risk in social engineering scenarios.

Zoom published details in security bulletin ZSB-25036. The advisory covers multiple Windows-based Zoom products including Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, the Meeting SDK, and Zoom Workplace VDI.

Critical Impact
Unauthenticated network attackers can extract confidential information from affected Zoom Windows clients when a user performs an expected action, with no privileges required.

Affected Products

Zoom Workplace Desktop for Windows
Zoom Rooms and Rooms Controller for Windows
Zoom Meeting Software Development Kit for Windows
Zoom Workplace Virtual Desktop Infrastructure for Windows

Discovery Timeline

2025-09-09 - CVE-2025-58135 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58135

Vulnerability Analysis

CVE-2025-58135 is an information disclosure flaw rooted in improper action enforcement within Zoom Workplace Clients for Windows. The client fails to correctly enforce that a specific action occurs exactly once or under expected conditions. This logic gap enables an attacker to observe or extract data that should remain internal to the client session.

Because the flaw sits in client-side action handling, exploitation does not require authentication to the Zoom service. Instead, the attacker relies on network reachability to the target client and a user interaction such as accepting a prompt, joining a meeting, or opening content delivered by the attacker.

The vulnerability does not impact integrity or availability. The confidentiality impact, however, is high because the disclosed data may include session artifacts or metadata that assist follow-on attacks.

Root Cause

The root cause is improper enforcement of a single, unique action [CWE-837]. The client permits an action to proceed in a state where security checks or single-execution guarantees are not correctly applied. This design gap allows attacker-controlled inputs to trigger a code path that emits information back to the network peer.

Attack Vector

The attack is executed over the network and requires user interaction. An unauthenticated attacker crafts network traffic or content that the Zoom client processes during normal use. When the victim performs an expected user action, the client enters the vulnerable state and discloses information to the attacker.

No verified proof-of-concept or exploit code is publicly available. See the Zoom Security Bulletin ZSB-25036 for vendor-supplied technical context and fixed versions.

Detection Methods for CVE-2025-58135

Indicators of Compromise

Outbound connections from Zoom.exe or Zoom Rooms processes to unexpected external hosts outside normal Zoom infrastructure ranges.
Anomalous meeting join events followed by unusual data transfer volumes from Zoom client processes.
Zoom Workplace Client versions on Windows endpoints running builds prior to those listed as fixed in ZSB-25036.

Detection Strategies

Inventory installed Zoom Workplace, Rooms, Rooms Controller, Meeting SDK, and VDI versions on Windows and compare against fixed builds in ZSB-25036.
Monitor process telemetry for Zoom client child processes and network sockets that deviate from baseline behavior.
Correlate user interaction events (meeting joins, link clicks) with subsequent outbound network activity from Zoom processes.

Monitoring Recommendations

Alert on Zoom client versions that remain below the patched baseline across managed Windows endpoints.
Log DNS and TLS SNI values from Zoom processes to identify connections outside *.zoom.us and known Zoom CDN infrastructure.
Track user interaction with meeting invitations from external or untrusted senders.

How to Mitigate CVE-2025-58135

Immediate Actions Required

Update all Windows installations of Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, Meeting SDK, and Zoom Workplace VDI to the fixed versions listed in ZSB-25036.
Enforce automatic updates for Zoom clients through endpoint management tooling to prevent version drift.
Restrict acceptance of meetings and content from untrusted external senders until patching is complete.

Patch Information

Zoom has released fixed versions for the affected Windows clients. Refer to the Zoom Security Bulletin ZSB-25036 for exact fixed build numbers per product. Deploy the update through Zoom's automatic update mechanism, MSI-based enterprise deployment, or the IT admin portal.

Workarounds

No official workaround is published by Zoom; upgrading to the fixed version is the supported remediation path.
Limit exposure by disallowing external meeting participation on high-sensitivity endpoints until patched.
Educate users to avoid interacting with unsolicited meeting content, since exploitation requires user action.

bash

# Configuration example: query installed Zoom client version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX" /v DisplayVersion

# Enforce silent MSI upgrade to a patched build
msiexec /i ZoomInstallerFull.msi /qn /norestart ZoomAutoUpdate="true"