Command Injection in Zoom Video Communications, Inc. products - CVE-2025-58132
Published: October 14, 2025
Vulnerability identifier: #VU116990
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2025-58132
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Zoom Video Communications, Inc.
Affected software:
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Detailed vulnerability description
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient input validation. A remote attacker can trick the victim into clicking on a specially crafted URL and gain access to sensitive information.
How to mitigate CVE-2025-58132
Install updates from vendor's website.