CVE-2025-62483: Zoom SDK Information Disclosure Flaw

CVE-2025-62483 Overview

CVE-2025-62483 is a high-severity information disclosure vulnerability affecting multiple Zoom client applications before version 6.5.10. The vulnerability stems from improper removal of sensitive information (CWE-212), allowing unauthenticated attackers to potentially access confidential data via network access. This flaw poses significant risks to organizations relying on Zoom for secure communications, as sensitive meeting data, credentials, or user information could be exposed to unauthorized parties.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely via network access to disclose sensitive information from affected Zoom clients, potentially compromising meeting confidentiality and user privacy across enterprise deployments.

Affected Products

• Zoom Meeting Software Development Kit (Linux, macOS, Windows) before version 6.5.10
• Zoom Rooms (iOS, macOS, Windows) before version 6.5.10
• Zoom Rooms Controller (Linux, macOS, Windows) before version 6.5.10
• Zoom Workplace Desktop (Linux, macOS, Windows) before version 6.5.10
• Zoom Workplace Virtual Desktop Infrastructure (Windows) before version 6.5.10

Discovery Timeline

• 2025-11-13 - CVE-2025-62483 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-62483

Vulnerability Analysis

This vulnerability is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer), indicating that the affected Zoom clients fail to properly sanitize or remove sensitive data before it is transmitted over the network or stored. This type of flaw typically occurs when applications process sensitive information but do not adequately cleanse data structures, memory buffers, or network payloads before they are exposed to external entities.

The vulnerability requires no authentication and can be exploited remotely over the network without user interaction. The impact is focused on confidentiality, meaning attackers could extract sensitive information without affecting the integrity or availability of the system.

Root Cause

The root cause lies in inadequate data sanitization within the Zoom client applications. When processing or transmitting data, residual sensitive information is not properly removed from memory buffers, data structures, or network communications. This could include meeting metadata, authentication tokens, user credentials, or other confidential information that persists in areas accessible to network-based attackers.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker with network access to a vulnerable Zoom client can potentially intercept or request data that contains improperly sanitized sensitive information. The attack complexity is low, making this vulnerability accessible to attackers without sophisticated tooling or techniques.

The exploitation scenario involves an unauthenticated attacker positioning themselves on the network path between Zoom clients or monitoring network traffic to capture sensitive data that should have been removed before transmission. In enterprise environments with multiple Zoom deployments, this could lead to widespread information disclosure affecting numerous users and meetings.

Detection Methods for CVE-2025-62483

Indicators of Compromise

• Unusual network traffic patterns to or from Zoom client applications
• Unexpected data exfiltration attempts targeting Zoom process memory or communications
• Anomalous queries or requests to Zoom endpoints from unauthorized sources
• Evidence of network sniffing or man-in-the-middle activity targeting Zoom traffic

Detection Strategies

• Deploy network monitoring to identify unusual Zoom client traffic patterns or unexpected data volumes
• Use endpoint detection and response (EDR) solutions to monitor Zoom process behavior for anomalous memory access
• Implement deep packet inspection for Zoom communications to detect potential information leakage
• Review security logs for unauthorized access attempts to Zoom-related services

Monitoring Recommendations

• Enable verbose logging on Zoom clients and centralize log collection for analysis
• Monitor for version discrepancies across Zoom deployments to identify unpatched clients
• Implement network segmentation to limit exposure of vulnerable Zoom clients
• Deploy SentinelOne agents on endpoints running Zoom clients for real-time threat detection

How to Mitigate CVE-2025-62483

Immediate Actions Required

• Update all affected Zoom clients to version 6.5.10 or later immediately
• Inventory all Zoom deployments across the organization to identify vulnerable versions
• Prioritize patching for systems handling sensitive meetings or confidential communications
• Restrict network access to Zoom clients until patches can be applied

Patch Information

Zoom has released security patches addressing this vulnerability in version 6.5.10 and later for all affected products. Organizations should download updates directly from official Zoom channels. For detailed information, refer to the Zoom Security Bulletin ZSB-25047.

The patch addresses the improper data sanitization issue by ensuring sensitive information is properly removed from memory and network communications before exposure. All affected products across Linux, macOS, Windows, and iOS platforms should be updated.

Workarounds

• Implement network segmentation to isolate Zoom clients from untrusted network segments
• Use VPN or encrypted tunnels for all Zoom communications until patching is complete
• Consider disabling non-essential Zoom features that may expose additional attack surface
• Enforce network access controls to limit which systems can communicate with Zoom clients

# Verify Zoom client version on endpoints
# Windows PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Zoom\*" | Select-Object DisplayVersion

# macOS Terminal
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString

# Linux
zoom --version