CVE-2025-30665
📋 TL;DR
A NULL pointer dereference vulnerability in Zoom Workplace Apps for Windows allows authenticated users to cause a denial of service through network access. This affects Zoom Workplace users on Windows systems where the vulnerable software is installed. The vulnerability requires authentication but can be exploited remotely.
💻 Affected Systems
- Zoom Workplace Apps for Windows
📦 What is this software?
Rooms by Zoom
Workplace Virtual Desktop Infrastructure by Zoom
View all CVEs affecting Workplace Virtual Desktop Infrastructure →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Zoom Workplace applications on affected systems, requiring restart or reinstallation.
Likely Case
Application crash affecting individual user sessions, disrupting meetings and collaboration features.
If Mitigated
Minimal impact with proper network segmentation and authentication controls limiting exploit surface.
🎯 Exploit Status
NULL pointer dereference typically requires specific conditions to trigger but is straightforward once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zoom advisory ZSB-25018 for specific patched versions
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25018
Restart Required: Yes
Instructions:
1. Visit Zoom's security bulletin ZSB-25018. 2. Download and install the latest patched version of Zoom Workplace Apps for Windows. 3. Restart the application and system if prompted.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom applications to trusted users only
Authentication Controls
allImplement strong authentication mechanisms to limit potential attackers
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with Zoom applications
- Monitor for abnormal application crashes and investigate potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Zoom application version against vulnerable versions listed in ZSB-25018 advisoryCheck Version:
In Zoom app: Help > About Zoom (shows version number)Verify Fix Applied:
Verify Zoom application version matches or exceeds patched version from ZSB-25018📡 Detection & Monitoring
Log Indicators:
- Unexpected Zoom application crashes
- Access logs showing repeated authentication attempts
Network Indicators:
- Unusual network traffic patterns to Zoom application ports
- Multiple connection attempts from single sources
SIEM Query:
source="zoom" AND (event="crash" OR event="exception")