Zoom Workplace CVE-2025-62484

Requires a Zoom Workplace Client or Meeting SDK build earlier than 6.5.10 on Android or iPhone OS (per the CPEs); versions at or above 6.5.10 are not affected. Exploitation requires the attacker to get the victim client to process attacker-controlled input through the vulnerable regular-expression code path - realistically via a shared network/meeting/messaging channel the client parses - so the practical limiting factor is reaching that specific parser on a mobile endpoint. The CVSS vector asserts UI:N (no user interaction) and PR:N (unauthenticated); the description states no additional special configuration, so default installations of the listed mobile clients below 6.5.10 are in scope.

Signals conflict sharply and must be weighed carefully. The input assigns CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which on its face describes a trivially-exploitable, unauthenticated, full-CIA-compromise flaw and would normally be a top-tier priority. However, the root weakness is CWE-1333 (inefficient regular expression complexity, i.e. ReDoS), whose mechanism is CPU/resource exhaustion - a class that overwhelmingly maps to an availability impact only, not to the confidentiality and integrity compromise (C:H/I:H) the vector claims, and the Tags list even includes 'Denial Of Service.' The description's label of 'escalation of privilege' is likewise atypical for a ReDoS and is not explained by the provided data. Exploitation-likelihood signals are uniformly low: EPSS is 0.12% (31st percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. Net assessment: despite the 9.8 headline, the combination of a DoS-class root cause, an internally inconsistent CVSS impact set, and low real-world exploitation probability means this is more plausibly a high-CVSS-but-lower-real-risk issue than an urgent, actively-exploited threat - BUT the CVSS/CWE impact mismatch should be verified with Zoom (bulletin ZSB-25048) before down-ranking, because if the EoP/C:H/I:H claims are accurate the severity stands.

A remote attacker crafts malicious input (e.g. a specially formed string delivered through a meeting, chat, or SDK-processed data path) that is parsed by the vulnerable regular expression in a Zoom Workplace or Meeting SDK client on Android or iOS before 6.5.10. The pathological pattern causes catastrophic regex backtracking, exhausting client CPU; the vendor further characterizes the outcome as an escalation of privilege, though the mechanism for that is not detailed in the available data. No public exploit code was identified at time of analysis.