CVE-2025-67461
📋 TL;DR
This vulnerability in Zoom Rooms for macOS allows authenticated local users to control file paths, potentially leading to information disclosure. It affects Zoom Rooms for macOS versions before 6.6.0 when accessed by authenticated users on the local system.
💻 Affected Systems
- Zoom Rooms for macOS
📦 What is this software?
Rooms by Zoom
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could manipulate file paths to access sensitive system files or configuration data, potentially exposing credentials, user data, or system information.
Likely Case
Local authenticated users could access files outside intended directories, potentially exposing Zoom configuration data or other application files.
If Mitigated
With proper access controls and patching, the risk is limited to authorized users accessing only intended application files.
🎯 Exploit Status
Requires authenticated local access and knowledge of macOS file system paths. No public exploit code has been disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.0
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25051
Restart Required: Yes
Instructions:
1. Open Zoom Rooms client on macOS. 2. Go to Settings > About. 3. Check for updates or download version 6.6.0 from Zoom's website. 4. Install the update and restart the application.
🔧 Temporary Workarounds
Restrict local user access
macOSLimit which users have authenticated access to macOS systems running Zoom Rooms
Implement file system restrictions
macOSUse macOS sandboxing or file system permissions to restrict Zoom Rooms' file access
🧯 If You Can't Patch
- Restrict physical and remote desktop access to Zoom Rooms systems
- Implement strict user access controls and monitor for unusual file access patterns
🔍 How to Verify
Check if Vulnerable:
Check Zoom Rooms version in Settings > About. If version is below 6.6.0, the system is vulnerable.Check Version:
Open Zoom Rooms, go to Settings > About to view version numberVerify Fix Applied:
Confirm Zoom Rooms version is 6.6.0 or higher in Settings > About.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns by Zoom Rooms process
- Access to files outside expected Zoom directories
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process:Zoom AND (FileAccess:*/../* OR FileAccess:*../../*)