BigBlueButton CVE-2025-61601

Requires an authenticated participant in a live BigBlueButton meeting where a poll using the Choices response type is active; the attacker submits a poll vote whose answerIds field holds an extremely large array, which the server processes without bounds checking (CWE-703), freezing or crashing the meeting and potentially the whole server. Limiting factors: the attacker must hold a valid meeting session (not truly unauthenticated despite CVSS PR:N), and a Choices-type poll must be running for the vote path to be reachable. The fix caps answerIds at 100 entries, so only unpatched versions prior to 3.0.13 are affected; no workarounds exist.

CVSS 7.5 (High) is driven entirely by availability impact (C:N/I:N/A:H) with no confidentiality or integrity consequence - this is a pure DoS. The published CVSS vector states PR:N (unauthenticated), but the description explicitly requires 'any authenticated user', so there is a direct conflict: the attacker must first be a logged-in meeting participant, which lowers real-world exposure versus a true unauthenticated network attack - verify PR with the vendor advisory. Publicly available exploit code exists (GHSA advisory plus a YouTube demonstration), which raises practical risk, but EPSS is low at 0.47% (39th percentile), consistent with no mass-exploitation trend and the fact that abuse requires an authenticated session and an active poll. This is not CISA KEV listed, so there is no confirmed active exploitation. Net: a credible, demonstrable availability threat for internet-facing BigBlueButton servers that admit untrusted participants (e.g., open education platforms), but materially gated by the authentication requirement and the absence of data-theft or RCE potential - prioritize patching on multi-tenant/public instances, lower urgency on closed, trusted-user deployments.

An attacker joins a BigBlueButton meeting as an ordinary authenticated participant and, when a poll of the Choices type is active, submits a crafted vote whose answerIds field contains a massive array. Processing this oversized array exhausts server resources, freezing or crashing the current meeting and potentially all meetings on the host. Public proof-of-concept exists, including a video demonstration, so exploitation is low-effort given the low attack complexity (AC:L).