Insecure Default Variable Initialization in Zoom Video Communications, Inc. products - CVE-2025-27443

Vulnerability identifier: #VU107150

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-27443

CWE-ID: CWE-453

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insecure default variable initialization. A local user can escalate privileges on the system.

Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Zoom Rooms Controller for Windows
Zoom Meeting SDK for Windows

Install updates from vendor's website.

Zoom Workplace Desktop App for Windows - update to 6.3.10 59437
Zoom Rooms Client for Windows - update to 6.4.0
Zoom Meeting SDK for Windows - update to 6.3.10
Zoom Rooms Controller for Windows - update to 6.4.0

• https://www.zoom.com/en/trust/security-bulletin/ZSB-25014/

• Privilege escalation in Zoom Workplace apps for Windows