CVE-2025-64739
📋 TL;DR
This vulnerability in Zoom Clients allows unauthenticated attackers to control file paths, potentially leading to information disclosure via network access. It affects Zoom users running vulnerable client versions, allowing attackers to access sensitive files if they can interact with the client over a network.
💻 Affected Systems
- Zoom Client
📦 What is this software?
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
⚠️ Risk & Real-World Impact
Worst Case
An attacker could access sensitive local files by manipulating file paths, potentially exposing credentials, configuration files, or other confidential data.
Likely Case
Limited information disclosure of non-critical files accessible through controlled file paths, potentially revealing user preferences or configuration details.
If Mitigated
With proper network segmentation and access controls, the attack surface is reduced to internal networks only, limiting exposure.
🎯 Exploit Status
Exploitation requires network access to vulnerable client and knowledge of file path manipulation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check ZSB-25041 for specific patched versions
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25041
Restart Required: Yes
Instructions:
1. Open Zoom Client
2. Click your profile picture
3. Select 'Check for Updates'
4. Install any available updates
5. Restart Zoom Client
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom clients to trusted networks only
Disable Unnecessary Features
allDisable file transfer and other non-essential features in Zoom settings
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with Zoom clients
- Monitor for unusual file access patterns or network connections to Zoom clients
🔍 How to Verify
Check if Vulnerable:
Check Zoom Client version against affected versions listed in ZSB-25041Check Version:
Windows: Open Zoom > Settings > About > Version; macOS: Zoom > About Zoom; Linux: zoom --versionVerify Fix Applied:
Verify Zoom Client version is updated to patched version specified in ZSB-25041📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from Zoom process
- Failed file path resolution attempts in Zoom logs
Network Indicators:
- Unexpected network connections to Zoom client ports
- Unusual file transfer patterns
SIEM Query:
process_name="Zoom.exe" AND (event_type="file_access" OR event_type="network_connection")