CVE-2025-30662

Published: Nov 13, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.

Affected (3)

Products: Zoom: Workplace Virtual Desktop Infrastructure

Zoom

1 product

Workplace Virtual Desktop Infrastructure

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Zoom Workplace Virtual Desktop Infrastructure	Before 6.3.14
Zoom Workplace Virtual Desktop Infrastructure	From 6.4.0 to 6.4.14
Zoom Workplace Virtual Desktop Infrastructure	From 6.5.0 to 6.5.10

Related CWEs

CWE-646

Reliance on File Name or Extension of Externally-Supplied File

The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

References (1)

https://www.zoom.com/en/trust/security-bulletin/zsb-25045

Source: security@zoom.us

Vendor Advisory

Timeline

No history available yet.