Zoom Rooms CVE-2025-67461
MEDIUMSeverity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local access and prior authentication are required (AV:L, PR:L), no user interaction, and the flaw only discloses information (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.
AnalysisAI
Local information disclosure in Zoom Rooms for macOS before version 6.6.0 allows an authenticated local user to exploit external control of a file name or path, potentially reading arbitrary files accessible to the Zoom Rooms process. The vulnerability requires an existing authenticated session on the host (PR:L) and cannot be triggered remotely or without authentication. With a CVSS base score of 5.5 and an EPSS score of 0.14%, it poses a low-priority risk; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The vulnerability is an instance of CWE-73: External Control of File Name or Path, where the Zoom Rooms for macOS application constructs a file path using user-supplied input without adequate validation. An authenticated local attacker can manipulate a file name or path parameter to cause the application to read an arbitrary file, leading to information disclosure. The affected product is identified by CPE cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:*:*, indicating the Zoom Rooms application on the macOS platform. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N shows that exploitation is local (AV:L), requires low privileges (PR:L), needs no user interaction (UI:N), and results in high confidentiality impact (C:H) with no integrity or availability impact. The EPSS score of 0.14% (3rd percentile) suggests a low likelihood of exploitation in the wild, and no public exploit or active exploitation is known.
RemediationAI
Upgrade Zoom Rooms for macOS to version 6.6.0 or later to address the vulnerability, as the flaw is fixed in that release. This is the primary and recommended remediation. For environments where immediate upgrade is not possible, consider restricting local access to trusted users only, since exploitation requires an authenticated local session and low privileges; however, this is not a substitute for patching. Additionally, monitor for any suspicious file access attempts by the Zoom Rooms process. The vendor advisory ZSB-25051 at https://www.zoom.com/en/trust/security-bulletin/zsb-25051 provides further details and update instructions.
Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Wind
Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of
Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via netwo
Improper input validation in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting clients before 5.14.0 may allow
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before ver
Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network acce
Buffer overflow in some Zoom Workplace Apps and Rooms Clients may allow an authenticated user to conduct an escalation o
Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial
Local privilege escalation in Zoom Rooms for Windows before 6.6.0 allows an attacker with local access and low-level pri
Local privilege escalation in Zoom Rooms for Windows before version 7.1.0 allows an authenticated low-privileged user to
Zoom Client for Windows contains a privilege escalation vulnerability that allows authenticated local users to gain elev
Improper input validation in the installer for some Zoom Apps for Windows may allow an authenticated user to conduct a p
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today