CVE-2025-30663 Details
Description
Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.
A time-of-check time-of-use race condition has been identified in certain Zoom Workplace applications. This vulnerability may allow an authenticated user to escalate privileges through local access. It affects the Zoom Workplace Desktop App for Windows, macOS, and Linux, as well as the Zoom Workplace App for iOS and Android. Additionally, it impacts the Zoom Workplace VDI Client for Windows (except versions 6.1.16 and 6.2.12), Zoom Rooms Controller and Client applications across various platforms, and the Zoom Meeting SDK for multiple operating systems, all prior to specific version releases.
Users are advised to update to the latest version of the Zoom Workplace App. The updated versions can be downloaded from the Zoom Download Center.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.zoom.com/en/trust/security-bulletin/zsb-25016 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zoom meeting software development kit | < 6.4.0 |
CPE
Remediation
| |
| zoom rooms | < 6.4.0 |
CPE
Remediation
| |
| zoom rooms controller | < 6.4.0 |
CPE
Remediation
| |
| zoom workplace | < 6.4.0 |
CPE
Remediation
| |
| zoom workplace desktop | < 6.4.0 |
CPE
Remediation
| |
| zoom workplace virtual desktop infrastructure | < 6.1.17 >= 6.1.18, < 6.2.13 >= 6.2.14, < 6.3.10 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 6, 2025 | Initial Analysis | [email protected] |
| May 14, 2025 | New CVE Received | [email protected] |