Skip to content
OpenAdvisories
High NCSC-2025-0368 9 CVEs

Kwetsbaarheden verholpen in Zoom Workplace en Zoom Clients

Published Nov 18, 2025 · Updated Nov 18, 2025 · nl

Vendor: Zoom Communications Product: Zoom Workplace Product: Zoom Workplace Clients Product: Zoom Workplace for Android Product: Zoom Workplace for macOS Product: Zoom Workplace VDI Client Product: Zoom Workplace VDI Plugin macOS Universal installer

Summary

Zoom heeft kwetsbaarheden verholpen in Zoom Workplace en Zoom Clients (Specifiek voor versies vóór 6.5.10).

Details

Interpretaties
De kwetsbaarheden omvatten onder andere ongepaste validatie van certificaten, cross-site scripting, en onjuiste behandeling van gevoelige informatie, wat kan leiden tot ongeautoriseerde toegang en informatie openbaarmaking door zowel geauthenticeerde als ongeauthenticeerde gebruikers.

Oplossingen
Zoom heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 9

  • High 8.1
    CVE-2025-62484

    Zoom Workplace Clients - Inefficient Regular Expression Complexity

    Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

    Zoom Communications Zoom Workplace
  • High 8.1
    CVE-2025-64741

    Zoom Workplace for Android - Improper Authorization Handling

    Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalation of privilege via network access.

    Zoom Communications Zoom Workplace for Android Android
  • High 7.5
    CVE-2025-64740

    Zoom Workplace VDI Client for Windows - Improper Verification of Cryptographic Signature

    Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

    Zoom Communications Zoom Workplace VDI Client
  • Medium 6.6
    CVE-2025-30662

    Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following

    Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Workplace VDI Plugin macOS Universal installer macOS
  • Medium 5.3
    CVE-2025-62483

    Zoom Clients - Improper Removal of Sensitive Information

    Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Clients
  • Medium 5.0
    CVE-2025-64738

    Zoom Workplace for macOS - External Control of File Name or Path

    External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.

    Zoom Communications Zoom Workplace for macOS macOS
  • Medium 4.8
    CVE-2025-30669

    Zoom Workplace Clients - Improper Certificate Validation

    Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacent access.

    Zoom Communications Zoom Workplace Clients
  • Medium 4.3
    CVE-2025-62482

    Zoom Workplace for Windows - Cross-site Scripting

    Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network access.

    Zoom Communications Zoom Workplace
  • Medium 4.3
    CVE-2025-64739

    Zoom Clients - External Control of File Name or Path

    External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

    Zoom Communications Zoom Clients

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25040/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25041/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25042/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25043/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25044/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25045/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25046/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25047/
  • Reference
    https://www.zoom.com/en/trust/security-bulletin/ZSB-25048/