CVE-2025-27443

Published: Apr 8, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.

Affected (4)

Products: Zoom: Meeting Software Development Kit, Rooms, Rooms Controller, Workplace Desktop

Zoom

4 products

Meeting Software Development Kit

Rooms

Rooms Controller

Workplace Desktop

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Zoom Meeting Software Development Kit	Before 6.3.10
Zoom Rooms	Before 6.4.0
Zoom Rooms Controller	Before 6.4.0
Zoom Workplace Desktop	Before 6.3.10

Related CWEs

CWE-1188

Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (1)

https://www.zoom.com/en/trust/security-bulletin/zsb-25014

Source: security@zoom.us

Vendor Advisory

Timeline

No history available yet.