Insecure Default Variable Initialization in Zoom Video Communications, Inc. products - CVE-2025-27443
Published: April 8, 2025
Vulnerability identifier: #VU107150
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-27443
CWE-ID: CWE-453
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Zoom Video Communications, Inc.
Affected software:
Zoom Workplace Desktop App for Windows
Zoom Rooms Controller for Windows
Zoom Rooms Client for Windows
Zoom Meeting SDK for Windows
Zoom Workplace Desktop App for Windows
Zoom Rooms Controller for Windows
Zoom Rooms Client for Windows
Zoom Meeting SDK for Windows
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insecure default variable initialization. A local user can escalate privileges on the system.
How to mitigate CVE-2025-27443
Install updates from vendor's website.