Zoom Workplace CVE-2025-58132

Exploitation requires the attacker to be an authenticated user (CVSS PR:L) with network access to a vulnerable Zoom client for Windows - specifically Zoom Workplace Desktop, Zoom Meeting SDK, Zoom Rooms, or Zoom Workplace VDI. No user interaction is needed (UI:N). The limiting factors are: valid authentication/session within the Zoom environment is mandatory, the target must run one of the affected Windows client products at a vulnerable version, and impact is confined to information disclosure (C:H only) with no code execution, data modification, or denial of service. The exact triggering feature or client component is not stated in the available data and should be confirmed against Zoom bulletin ZSB-25038.

This is a moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-reachable flaw with low attack complexity but requiring an authenticated user (PR:L), limited strictly to high confidentiality impact with no integrity or availability effect. EPSS is 1.82% (78th percentile) - elevated above baseline but still low in absolute terms, consistent with no confirmed active exploitation. There is no CISA KEV listing and no public proof-of-concept identified in the provided data, so this remains no public exploit identified at time of analysis. A notable internal tension: the CWE-77 classification and the word 'command injection' typically imply code execution / integrity impact, yet both the description and the CVSS vector scope this to information disclosure only (C:H, I:N, A:N) - this suggests the injection yields read access to data rather than full command execution, and the discrepancy between 'command injection' labeling and a confidentiality-only impact should be verified against the Zoom security bulletin (ZSB-25038). The requirement for authentication meaningfully lowers real-world risk relative to the raw score.

An attacker who already holds valid authenticated access within the Zoom environment sends crafted input over the network to a vulnerable Zoom client component on Windows, triggering a command injection that is leveraged to read and disclose sensitive information rather than take over the host. No user interaction is required. No public exploit code has been identified at the time of analysis.