CVE-2025-64739

Published: Nov 13, 2025Modified: Oct 18, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

Affected (14)

Products: Zoom: Meeting Software Development Kit, Rooms, Rooms Controller, Workplace Desktop, Workplace Virtual Desktop Infrastructure

Zoom

5 products

Meeting Software Development Kit

Rooms

Rooms Controller

Workplace Desktop

Workplace Virtual Desktop Infrastructure

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Zoom Meeting Software Development Kit	version < 6.5.10
Zoom Meeting Software Development Kit	version < 6.5.10
Zoom Meeting Software Development Kit	version < 6.5.10
Zoom Rooms	version < 6.5.10
Zoom Rooms	version < 6.5.10
Zoom Rooms	version < 6.5.10
Zoom Rooms Controller	version < 6.5.10
Zoom Rooms Controller	version < 6.5.10
Zoom Rooms Controller	version < 6.5.10
Zoom Workplace Desktop	version < 6.5.10
Zoom Workplace Desktop	version < 6.5.10
Zoom Workplace Desktop	version < 6.5.10
Zoom Workplace Virtual Desktop Infrastructure	version < 6.3.14
Zoom Workplace Virtual Desktop Infrastructure	6.4.10 ≤ version < 6.4.12

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (1)

https://www.zoom.com/en/trust/security-bulletin/zsb-25041

Source: security@zoom.us

Vendor Advisory

Timeline

No history available yet.