CVE-2025-62483: Zoom SDK Information Disclosure Flaw

CVE-2025-62483 Overview

CVE-2025-62483 is a high-severity information disclosure vulnerability affecting multiple Zoom client applications before version 6.5.10. The vulnerability stems from improper removal of sensitive information (CWE-212), allowing unauthenticated attackers to potentially access confidential data via network access. This flaw poses significant risks to organizations relying on Zoom for secure communications, as sensitive meeting data, credentials, or user information could be exposed to unauthorized parties.

Critical Impact
Unauthenticated attackers can exploit this vulnerability remotely via network access to disclose sensitive information from affected Zoom clients, potentially compromising meeting confidentiality and user privacy across enterprise deployments.

Affected Products

Zoom Meeting Software Development Kit (Linux, macOS, Windows) before version 6.5.10
Zoom Rooms (iOS, macOS, Windows) before version 6.5.10
Zoom Rooms Controller (Linux, macOS, Windows) before version 6.5.10
Zoom Workplace Desktop (Linux, macOS, Windows) before version 6.5.10
Zoom Workplace Virtual Desktop Infrastructure (Windows) before version 6.5.10

Discovery Timeline

2025-11-13 - CVE-2025-62483 published to NVD
2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-62483

Vulnerability Analysis

This vulnerability is classified under CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer), indicating that the affected Zoom clients fail to properly sanitize or remove sensitive data before it is transmitted over the network or stored. This type of flaw typically occurs when applications process sensitive information but do not adequately cleanse data structures, memory buffers, or network payloads before they are exposed to external entities.

The vulnerability requires no authentication and can be exploited remotely over the network without user interaction. The impact is focused on confidentiality, meaning attackers could extract sensitive information without affecting the integrity or availability of the system.

Root Cause

The root cause lies in inadequate data sanitization within the Zoom client applications. When processing or transmitting data, residual sensitive information is not properly removed from memory buffers, data structures, or network communications. This could include meeting metadata, authentication tokens, user credentials, or other confidential information that persists in areas accessible to network-based attackers.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker with network access to a vulnerable Zoom client can potentially intercept or request data that contains improperly sanitized sensitive information. The attack complexity is low, making this vulnerability accessible to attackers without sophisticated tooling or techniques.

The exploitation scenario involves an unauthenticated attacker positioning themselves on the network path between Zoom clients or monitoring network traffic to capture sensitive data that should have been removed before transmission. In enterprise environments with multiple Zoom deployments, this could lead to widespread information disclosure affecting numerous users and meetings.

Detection Methods for CVE-2025-62483

Indicators of Compromise

Unusual network traffic patterns to or from Zoom client applications
Unexpected data exfiltration attempts targeting Zoom process memory or communications
Anomalous queries or requests to Zoom endpoints from unauthorized sources
Evidence of network sniffing or man-in-the-middle activity targeting Zoom traffic

Detection Strategies

Deploy network monitoring to identify unusual Zoom client traffic patterns or unexpected data volumes
Use endpoint detection and response (EDR) solutions to monitor Zoom process behavior for anomalous memory access
Implement deep packet inspection for Zoom communications to detect potential information leakage
Review security logs for unauthorized access attempts to Zoom-related services

Monitoring Recommendations

Enable verbose logging on Zoom clients and centralize log collection for analysis
Monitor for version discrepancies across Zoom deployments to identify unpatched clients
Implement network segmentation to limit exposure of vulnerable Zoom clients
Deploy SentinelOne agents on endpoints running Zoom clients for real-time threat detection

How to Mitigate CVE-2025-62483

Immediate Actions Required

Update all affected Zoom clients to version 6.5.10 or later immediately
Inventory all Zoom deployments across the organization to identify vulnerable versions
Prioritize patching for systems handling sensitive meetings or confidential communications
Restrict network access to Zoom clients until patches can be applied

Patch Information

Zoom has released security patches addressing this vulnerability in version 6.5.10 and later for all affected products. Organizations should download updates directly from official Zoom channels. For detailed information, refer to the Zoom Security Bulletin ZSB-25047.

The patch addresses the improper data sanitization issue by ensuring sensitive information is properly removed from memory and network communications before exposure. All affected products across Linux, macOS, Windows, and iOS platforms should be updated.

Workarounds

Implement network segmentation to isolate Zoom clients from untrusted network segments
Use VPN or encrypted tunnels for all Zoom communications until patching is complete
Consider disabling non-essential Zoom features that may expose additional attack surface
Enforce network access controls to limit which systems can communicate with Zoom clients

bash

# Verify Zoom client version on endpoints
# Windows PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Zoom\*" | Select-Object DisplayVersion

# macOS Terminal
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString

# Linux
zoom --version