CVE-2025-64739: 
Zoom Rooms vulnerability analysis and mitigation

CVE-2025-64739 is an External Control of File Name or Path (CWE-73) vulnerability in multiple Zoom client products that may allow an unauthenticated attacker to disclose sensitive information via network access. It was disclosed by Zoom Video Communications on November 11, 2025, and published to NVD on November 13, 2025. Affected products include Zoom Workplace Desktop (Windows, macOS, Linux), Zoom Rooms (Windows, macOS, iOS), Zoom Rooms Controller (Windows, macOS, Linux), Zoom Meeting SDK (Windows, macOS, Linux), and Zoom Workplace VDI — all versions prior to 6.5.10 (VDI: prior to 6.3.14 or 6.4.10–6.4.12). NIST NVD assigns a CVSS v3.1 base score of 7.5 (High), while Zoom's own CNA assessment is 4.3 (Medium) (Zoom Advisory).

The vulnerability is classified as CWE-73 (External Control of File Name or Path), meaning the application allows externally supplied input to influence file system paths without adequate validation or sanitization. An unauthenticated attacker can leverage this flaw over the network to reference or traverse to arbitrary file paths within the Zoom client environment, potentially exposing files accessible to the client process. The Zoom CNA scoring (UI:R) suggests some degree of user interaction may be involved in certain exploitation scenarios, while NIST's assessment (UI:N) indicates exploitation may also be possible without user interaction. No public proof-of-concept code has been identified at this time (Zoom Advisory).

Successful exploitation results in unauthorized disclosure of information, with a high confidentiality impact per NIST's assessment and a low confidentiality impact per Zoom's own scoring. There is no integrity or availability impact associated with this vulnerability. The broad scope of affected products — spanning desktop, room systems, mobile, and SDK clients across Windows, macOS, Linux, and iOS — means a wide range of enterprise and consumer deployments could be exposed to file content disclosure (Zoom Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-64739. The EPSS score is approximately 0.029%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugins (IDs 274737, 274738, 274739) are available for identifying vulnerable installations (Zoom Advisory).

Zoom has released patched versions addressing this vulnerability. Users should update to Zoom Workplace Desktop, Rooms, Rooms Controller, and Meeting SDK version 6.5.10 or later on all platforms. For Zoom Workplace VDI on Windows, update to version 6.3.14 or later (for the pre-6.4.x branch) or to 6.4.12 or later (for the 6.4.x branch). Updates are available via the official Zoom download page at https://zoom.us/download. No configuration-based workarounds have been published; upgrading is the recommended remediation (Zoom Advisory).

Coverage of CVE-2025-64739 appeared in cybersecurity news outlets including CyberSecurityNews and The Hacker News (as part of weekly vulnerability recaps), as well as threat intelligence aggregators such as Hawk-Eye and VulDB. Community reaction has been moderate, with the vulnerability noted alongside other Zoom security issues disclosed in the same bulletin (ZSB-25041). No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified (CyberSecurityNews, The Hacker News).