Analysis Summary

CVE-2025-30670 CVSS:6.5

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

CVE-2025-30671 CVSS:6.5

Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.

CVE-2025-30672 CVSS:6.5

Mite for Perl versions before 0.013000 has a vulnerability related to its code generation process. The software adds the current working directory ('.') to the @INC path, which is similar to the issue identified in CVE-2016-1238. This configuration allows an attacker who can place a malicious file in the current working directory to potentially replace legitimate files during loading. As a result, the vulnerability could enable arbitrary code execution. The security issue impacts both the Mite distribution itself and other distributions that include code generated by Mite.

CVE-2025-27443 CVSS:2.8

Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local access.

CVE-2025-27441 CVSS:4.6

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

CVE-2025-27442 CVSS:4.6

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.

Impact

• Denial of Service
• Cross-Site Scripting
• Code Execution

Indicators of Compromise

CVE

• CVE-2025-30670
• CVE-2025-30671
• CVE-2025-30672
• CVE-2025-27443
• CVE-2025-27441
• CVE-2025-27442

Affected Vendors

Remediation

Refer to Zoom Security Advisory for patch, upgrade or suggested workaround information.

CVE-2025-30670

CVE-2025-30671

CVE-2025-30672

CVE-2025-27443

CVE-2025-27441

CVE-2025-27442