Zoom informed customers on Tuesday that it has patched five vulnerabilities in its applications, including four rated ‘high severity’.
The high-severity vulnerabilities are tracked as CVE-2025-27440, CVE-2025-27439, CVE-2025-0151 and CVE-2025-0150.
Three of them have been described as memory-related issues that can be exploited for privilege escalation via network access. Authentication is required for exploitation.
They affect Zoom Workplace, Rooms Controller, Rooms Client, and Meeting SDK products, prior to version 6.3.0.
These Zoom applications are also affected by a medium-severity issue related to the verification of data authenticity, which can be exploited by an unprivileged user for denial of service (DoS) attacks through network access.
The fourth high-severity vulnerability affects the Zoom Workplace app and Meeting SDK for iOS, and it can be exploited by an authenticated attacker for DoS.
All of the vulnerabilities were discovered internally by Zoom’s offensive security team.
Related: Nvidia, Zoom, Zyxel Patch High-Severity Vulnerabilities
Related: High-Severity Vulnerabilities Patched in Zoom, Chrome
Related: Zoom Adding Post-Quantum End-to-End Encryption to Products