CVE-2025-64739: 
Zoom Rooms vulnerability analysis and mitigation

CVE-2025-64739 is a medium severity vulnerability affecting various Zoom Client applications, discovered and disclosed on November 11, 2025. The vulnerability involves external control of file name or path in Zoom Clients that could potentially expose sensitive information. This security flaw affects multiple Zoom products including Zoom Workplace for Windows, macOS, and Linux, as well as Zoom Rooms and VDI Client versions prior to 6.5.10 (Zoom Bulletin).

The vulnerability has been assigned a CVSS score of 4.3 with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating medium severity. The flaw allows external control of file name or path, which could enable unauthenticated users to access information through network access. The vulnerability was identified and reported by Zoom Engineering Security team (Zoom Bulletin).

The vulnerability could lead to unauthorized disclosure of information when exploited by an unauthenticated user via network access. This path manipulation vulnerability potentially allows adversaries to redirect file operations to unintended locations, risking data leakage (Cyber Security News).

Zoom has released patches to address this vulnerability. Users are advised to update to version 6.5.10 or later of affected Zoom products. The fix is available through the official Zoom download center at https://zoom.us/download (Zoom Bulletin).