Zoom has disclosed two critical security vulnerabilities in its Zoom Rooms software for Windows and macOS, which could allow attackers with local access to escalate privileges or expose sensitive information.
Tracked as ZSB-25050 and ZSB-25051, these flaws affect versions prior to 6.6.0 and carry high-to-medium CVSS scores. Organizations relying on Zoom Rooms for conference setups face elevated risks in shared environments like boardrooms or huddle spaces.
The issues stem from a software downgrade protection failure on Windows and improper external control of file names on macOS, both of which are exploitable via local access. Security teams urge immediate patching to prevent unauthorized privilege gains or data disclosures.
Zoom Rooms for Windows before version 6.6.0 suffers from a protection mechanism failure, enabling unauthenticated local users to escalate privileges. This high-severity flaw, reported by an anonymous researcher, could let attackers gain elevated control over the system.
| Bulletin | CVE ID | CVSS Severity | CVSS Score | Vector String | Description |
|---|---|---|---|---|---|
| ZSB-25050 | CVE-2025-67460 | High | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Software downgrade protection failure allows unauthenticated privilege escalation via local access. |
Affected Products: Zoom Rooms for Windows < 6.6.0
On macOS, an authenticated user can exploit external control of file names or paths to disclose sensitive information. This medium-risk issue requires user interaction but could leak confidential data in enterprise deployments.
| Bulletin | CVE ID | CVSS Severity | CVSS Score | Vector String | Description |
|---|---|---|---|---|---|
| ZSB-25051 | CVE-2025-67461 | Medium | 5.0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | External control of file name/path allows info disclosure via local access. |
Affected Products: Zoom Rooms for macOS < 6.6.0
Zoom recommends updating to version 6.6.0 or later via the official download page. No evidence of active exploitation exists yet, but the local-access vector suits insider threats or compromised endpoints.
These flaws highlight ongoing risks in collaboration tools, especially post-hybrid work shifts. Enterprises should audit Zoom Rooms deployments, enforce least-privilege access, and monitor for downgrade attempts.
CISA has not yet issued alerts, but vulnerability trackers like NVD will soon list these CVEs.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
CISA's latest advisory for red teams warns critical infrastructure operators that security systems can fail…
Alice, the AI trust, safety, and security company formerly known as ActiveFence, has closed a…
SynkLoader is using Microsoft Teams conversations to turn routine IT support requests into a route…
ToxNetV2 is a Linux botnet that shows how artificial intelligence can move closer to real…
WhatsApp has confirmed that more than 1 billion people now use passkeys to log into…
ASOS US Sales LLC reported unauthorized access to customer accounts using credentials obtained from outside…