UNIX symbolic link following in Zoom Video Communications, Inc. products - CVE-2025-0146

Vulnerability identifier: #VU105765

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-0146

CWE-ID: CWE-61

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a symlink following issue. A local user can create a specially crafted symbolic link to a critical file on the system and overwrite it with privileges of the application, resulting in a denial of service.

Zoom Video SDK for macOS
Zoom Meeting SDK for macOS
Zoom Rooms Client for macOS
Zoom Workplace Desktop App for macOS
Zoom Rooms Controller for macOS

Install updates from vendor's website.

Zoom Video SDK for macOS - update to 6.2.10
Zoom Rooms Client for macOS - update to 6.2.10
Zoom Workplace Desktop App for macOS - update to 6.2.10 43047
Zoom Meeting SDK for macOS - update to 6.2.10
Zoom Rooms Controller for macOS - update to 6.2.10

• https://www.zoom.com/en/trust/security-bulletin/zsb-25005/

• Arbitrary file corruption in Zoom apps and SDKs for macOS