Cyber Posture

CVE-2025-62484

High

Published: 13 November 2025

Published
13 November 2025
Modified
19 November 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS Score 0.0009 25.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

CVE-2025-62484 is a high-severity vulnerability stemming from inefficient regular expression complexity (CWE-1333) in certain Zoom Workplace Clients prior to version 6.5.10. This flaw affects the client software, enabling potential exploitation through crafted network input that triggers excessive computation during regex processing, commonly known as a ReDoS (Regular Expression Denial of Service) condition adapted for privilege escalation.

An unauthenticated attacker (PR:N) with network access (AV:N) can exploit this vulnerability with low complexity (AC:L), though it requires user interaction (UI:R), such as a user clicking a malicious link or accepting a connection in a Zoom session. Successful exploitation leads to escalation of privilege, granting high confidentiality (C:H) and integrity (I:H) impacts without affecting availability (A:N) or changing scope (S:U), as scored at CVSS 8.1 (CVSS:3.1). The attacker could potentially manipulate client privileges to access sensitive data or alter application behavior.

Zoom's security bulletin (ZSB-25048) advises updating affected Zoom Workplace Clients to version 6.5.10 or later as the primary mitigation, addressing the regex inefficiency to prevent exploitation.

Details

CWE(s)
CWE-1333

Affected Products

zoom
meeting software development kit
≤ 6.5.10 · ≤ 6.5.10
zoom
workplace
≤ 6.5.10 · ≤ 6.5.10

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The vulnerability is a client-side ReDoS flaw exploitable via crafted network input requiring user interaction, enabling client execution (T1203) and directly leading to privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References