CVE-2025-0151
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-0151 is a use-after-free vulnerability (CWE-416) affecting some Zoom Workplace Apps. Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The flaw may enable an authenticated user to conduct an escalation of privilege via network access.
An attacker with low privileges, such as an authenticated user on the network, can exploit this vulnerability despite its high attack complexity and lack of required user interaction. Successful exploitation changes the scope to high and grants high impacts across confidentiality, integrity, and availability, potentially allowing the attacker to elevate privileges within the affected Zoom Workplace Apps.
Zoom has published details and mitigation guidance in security bulletin ZSB-25010, available at https://www.zoom.com/en/trust/security-bulletin/zsb-25010/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Use-after-free vulnerability in Zoom client apps directly enables remote authenticated privilege escalation (high impact, scope change), matching Exploitation for Privilege Escalation.