BigBlueButton CVE-2025-61602

Requires an authenticated user who has already joined a BigBlueButton meeting (versions prior to 3.0.13); the attacker sends the GraphQL mutation chatSendMessageReaction carrying a malformed reactionEmojiId, which is not validated before being handled and persisted. Limiting factors: exploitation is confined to participants of a meeting the attacker can access, so it demands valid meeting access/credentials rather than anonymous internet reach; impact is limited to crashing chat functionality for that meeting's participants with no confidentiality or integrity effect. No special non-default configuration or user interaction is required, and no workaround exists short of upgrading to 3.0.13.

This is a medium-to-high priority availability issue whose signals are mostly consistent but contain one notable conflict. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N), a network vector, and low attack complexity. The vendor's own GitHub Security Advisory description, however, states the attacker must be 'any authenticated user' - i.e. a user who has joined a meeting - which contradicts the PR:N (no privileges required) in the supplied CVSS vector. Per the available description this should realistically be PR:L, which would lower the true base score below 7.5; the inflated vector likely stems from treating meeting-join as unprivileged. EPSS is low at 0.39% (32nd percentile), consistent with a product that is not mass-internet-scanned and a vulnerability that produces disruption rather than code execution or data theft. There is no CISA KEV listing, so there is no evidence of active exploitation; the POC/exploit signal comes from the vendor advisory (GHSA-45j2-m26c-3pcm) and the public patch PR #23651, which together make the trigger trivially reproducible. No SSVC decision data was provided. Net assessment: a real but bounded risk - trivial for any meeting participant to weaponize against co-participants, but it requires insider/authenticated access, causes only a chat crash (not host compromise), and is confined to a single meeting's participants. Treat as an insider/abuse-resistance patch priority for education and conferencing operators rather than an internet-facing emergency.

An attacker who has legitimately joined a BigBlueButton meeting (e.g. a student or invited guest) issues the GraphQL mutation chatSendMessageReaction with a malformed reactionEmojiId value. The unhandled value propagates into the reaction handler and database insert path, crashing the chat functionality for every participant in that meeting. A publicly available exploit/trigger is documented in the vendor advisory GHSA-45j2-m26c-3pcm, making reproduction straightforward.