CVE-2025-27439
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-27439 is a buffer underflow vulnerability, classified under CWE-124, affecting some Zoom Workplace Apps. Published on 2025-03-11, it carries a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The issue may enable an authenticated user to achieve an escalation of privilege through network access.
An attacker with low privileges (PR:L), such as an authenticated user on the network, can exploit this vulnerability remotely (AV:N). Exploitation requires high attack complexity (AC:H) but no user interaction (UI:N), resulting in a scope change (S:C) with high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H). Successful attacks allow privilege escalation within the affected Zoom Workplace Apps.
Mitigation details are provided in the Zoom security bulletin ZSB-25011, available at https://www.zoom.com/en/trust/security-bulletin/zsb-25011/. Security practitioners should consult this advisory for patching instructions and recommended actions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer underflow vulnerability directly enables remote exploitation by authenticated users to achieve privilege escalation on affected Zoom apps.