Zoom Workplace CVE-2025-64741

The target must be running Zoom Workplace for Android (or the Zoom Meeting Software Development Kit for Android) at a version earlier than 6.5.10; updating to 6.5.10 or later remediates the flaw. The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication, no special configuration, and no user interaction are required, so in principle this is remote unauthenticated exploitation against default configurations of the Zoom Workplace Android client. The key LIMITING factor is reachability: as a mobile client rather than a listening server, the device must be network-reachable to the attacker (e.g., connected to attacker-controlled infrastructure or a shared/hostile network, or induced to communicate with a malicious endpoint) - the vendor advisory does not specify this path, and that reachability requirement materially constrains real-world exploitability despite the 9.8 score.

The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) frames this as a maximally severe, network-reachable, unauthenticated, no-interaction flaw with full confidentiality, integrity, and availability impact. However, the corroborating real-world signals are weak and partly conflicting. EPSS is only 0.15% (35th percentile), indicating a low modeled probability of exploitation in the near term, and the vulnerability is NOT in CISA KEV and has no public exploit identified - so there is no evidence of active or imminent exploitation. There is also a notable internal tension: the affected product is a mobile CLIENT application (Zoom Workplace for Android), yet the vector is scored AV:N/PR:N/UI:N; a client app being remotely exploitable by a fully unauthenticated attacker with no user interaction is unusual and typically implies the victim must at least connect to attacker-controlled content or join a session - the sparse Zoom advisory does not explain the reachability model, so the true attack vector should be verified with the vendor. Additionally, the assigned CWE-74 (Injection) does not match the description's 'improper authorization handling,' a classification inconsistency. Net assessment: high theoretical severity but currently low demonstrated real-world risk - prioritize patching for its criticality and broad deployment, but the absence of KEV/POC and the low EPSS suggest this is not yet under opportunistic mass exploitation.

An attacker with network reachability to a vulnerable Zoom Workplace for Android client (version before 6.5.10) sends crafted traffic that abuses the improper authorization check to perform actions as a higher-privileged context without authenticating. Per the CVSS vector this requires no privileges and no user interaction, potentially yielding full compromise of the client's data and functions. No public proof-of-concept exists at time of analysis, and the exact remote reachability path is not detailed in the vendor advisory.