Known vulnerabilities in Zoom Rooms Client for Android

Vendor: Zoom Video Communications, Inc.
Software: Zoom Rooms Client for Android
Software CPE: cpe:2.3:a:zoom_video_communications:zoom_rooms_client_for_android:*:*:*:*:*:*:*:*
Website: https://zoom.us/
Total vulnerabilities: 16
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Zoom Rooms Client for Android Zoom Rooms Client for Android is affected by 16 known vulnerabilities: 3 high, 7 medium, 6 low Critical High Medium Low

Vulnerabilities (16)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU116989 - Improper Authentication
CVE-2025-58133		 CWE-287 Medium
No
No
 6.5.1 14.10.2025 SB2025101452
#VU114991 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49461		 CWE-79 Low
No
No
 6.5.0 09.09.2025 SB2025090906
#VU114990 - Argument Injection or Modification
CVE-2025-49460		 CWE-88 Medium
No
No
 6.5.0 09.09.2025 SB2025090905
#VU112512 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49462		 CWE-79 Medium
No
No
 6.4.5 08.07.2025 SB2025070855
#VU109406 - Improper input validation
CVE-2025-46787		 CWE-20 Medium
No
No
 6.4.0 19.05.2025 SB2025051313
#VU109009 - Improper input validation
CVE-2025-46786		 CWE-20 Medium
No
No
 6.4.0 13.05.2025 SB2025051313
#VU109007 - NULL Pointer Dereference
CVE-2025-30668		 CWE-476 Low
No
No
 6.4.0 13.05.2025 SB2025051313
#VU109006 - NULL Pointer Dereference
CVE-2025-30667		 CWE-476 Low
No
No
 6.4.0 13.05.2025 SB2025051313
#VU109003 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-30664		 CWE-78 Low
No
No
 6.4.0 13.05.2025 SB2025051313
#VU109001 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-30663		 CWE-362 Low
No
No
 6.4.0 13.05.2025 SB2025051313
#VU107149 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27442		 CWE-79 Medium
No
No
 6.4.0 08.04.2025 SB2025040838
#VU107148 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-27441		 CWE-79 Medium
No
No
 6.4.0 08.04.2025 SB2025040838
#VU105776 - Insufficient Verification of Data Authenticity
CVE-2025-0149		 CWE-345 Low
No
No
 6.3.0 17.03.2025 SB2025031735
#VU105774 - Use After Free
CVE-2025-0151		 CWE-416 High
No
No
 6.3.0 17.03.2025 SB2025031733
#VU105773 - Buffer Underwrite ('Buffer Underflow')
CVE-2025-27439		 CWE-124 High
No
No
 6.3.0 17.03.2025 SB2025031732
#VU105772 - Heap-based Buffer Overflow
CVE-2025-27440		 CWE-122 High
No
No
 6.3.0 17.03.2025 SB2025031730