CVE-2025-30667
📋 TL;DR
A NULL pointer dereference vulnerability in Zoom Workplace Apps for Windows allows authenticated users to cause denial of service through network access. This affects Zoom Workplace users on Windows systems where an attacker with valid credentials can crash the application.
💻 Affected Systems
- Zoom Workplace Apps
📦 What is this software?
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Workplace Virtual Desktop Infrastructure by Zoom
View all CVEs affecting Workplace Virtual Desktop Infrastructure →
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to service disruption for affected users, potentially requiring restart of Zoom applications or system reboot.
Likely Case
Temporary denial of service for individual users, causing Zoom application crashes that disrupt meetings and collaboration.
If Mitigated
Minimal impact with proper network segmentation and authentication controls limiting exploit attempts.
🎯 Exploit Status
Exploitation requires authenticated access but NULL pointer dereferences are typically straightforward to trigger once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zoom advisory ZSB-25019 for specific patched versions
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25019
Restart Required: Yes
Instructions:
1. Open Zoom Workplace application
2. Navigate to Settings > About
3. Check for updates or download latest version from Zoom website
4. Install update and restart application
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom applications to trusted users only
Authentication Controls
allImplement strong authentication and monitor for suspicious account activity
🧯 If You Can't Patch
- Implement network segmentation to limit Zoom application access to essential users only
- Monitor for Zoom application crashes and investigate patterns that might indicate exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Zoom application version against patched versions listed in ZSB-25019 advisoryCheck Version:
In Zoom: Settings > About > VersionVerify Fix Applied:
Confirm Zoom application version is updated to patched version and test application stability📡 Detection & Monitoring
Log Indicators:
- Unexpected Zoom application crashes
- Access attempts from unusual accounts or locations
Network Indicators:
- Unusual network traffic patterns to Zoom applications
- Multiple connection attempts followed by disconnections
SIEM Query:
source="zoom" AND (event="crash" OR event="exception")