Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-67461

Summary
Assigner-Zoom
Assigner Org ID-99b9af0d-a833-4a5d-9e2f-8b1324f35351
Published At-10 Dec, 2025 | 20:29
Updated At-10 Dec, 2025 | 21:27
Rejected At-
Credits

Zoom Rooms for macOS - External Control of File Name or Path

External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Zoom
Assigner Org ID:99b9af0d-a833-4a5d-9e2f-8b1324f35351
Published At:10 Dec, 2025 | 20:29
Updated At:10 Dec, 2025 | 21:27
Rejected At:
â–¼CVE Numbering Authority (CNA)
Zoom Rooms for macOS - External Control of File Name or Path

External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.

Affected Products
Vendor
Zoom Communications, Inc.Zoom Communications Inc.
Product
Zoom Rooms
Platforms
  • MacOS
Default Status
unaffected
Versions
Affected
  • From 0 before 6.6.0 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-73CWE-73: External Control of File Name or Path
Type: CWE
CWE ID: CWE-73
Description: CWE-73: External Control of File Name or Path
Metrics
VersionBase scoreBase severityVector
3.15.0MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Version: 3.1
Base score: 5.0
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.zoom.com/en/trust/security-bulletin/zsb-25051
N/A
Hyperlink: https://www.zoom.com/en/trust/security-bulletin/zsb-25051
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:security@zoom.us
Published At:10 Dec, 2025 | 21:16
Updated At:30 Dec, 2025 | 18:23

External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via local access.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.15.0MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Primary3.15.5MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Type: Secondary
Version: 3.1
Base score: 5.0
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Type: Primary
Version: 3.1
Base score: 5.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CPE Matches
Zoom Communications, Inc.
zoom
>>rooms>>Versions before 6.6.0(exclusive)
cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:*
Weaknesses
CWE IDTypeSource
CWE-73Secondarysecurity@zoom.us
CWE ID: CWE-73
Type: Secondary
Source: security@zoom.us
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.zoom.com/en/trust/security-bulletin/zsb-25051security@zoom.us
Vendor Advisory
Hyperlink: https://www.zoom.com/en/trust/security-bulletin/zsb-25051
Source: security@zoom.us
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

8Records found
CVE-2025-64738
Matching Score-10
Assigner-Zoom Communications, Inc.
ShareView Details
Matching Score-10
Assigner-Zoom Communications, Inc.
CVSS Score-5||MEDIUM
EPSS-0.02% / 3.69%
||
7 Day CHG~0.00%
Published-13 Nov, 2025 | 14:23
Updated-13 Jan, 2026 | 20:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Zoom Workplace for macOS - External Control of File Name or Path

External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosure of information via local access.

Action-Not Available
Vendor-Zoom Communications, Inc.
Product-workplace_desktopmeeting_software_development_kitZoom Workplace for macOS
CWE ID-CWE-73
External Control of File Name or Path
CVE-2023-39210
Matching Score-8
Assigner-Zoom Video Communications, Inc.
ShareView Details
Matching Score-8
Assigner-Zoom Video Communications, Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.03% / 9.88%
||
7 Day CHG~0.00%
Published-08 Aug, 2023 | 21:27
Updated-04 Oct, 2024 | 17:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Cleartext storage of sensitive information in Zoom Client SDK for Windows before 5.15.0 may allow an authenticated user to enable an information disclosure via local access.

Action-Not Available
Vendor-Zoom Communications, Inc.
Product-meeting_software_development_kitZoom Client SDK for Windows
CWE ID-CWE-312
Cleartext Storage of Sensitive Information
CVE-2024-45417
Matching Score-8
Assigner-Zoom Video Communications, Inc.
ShareView Details
Matching Score-8
Assigner-Zoom Video Communications, Inc.
CVSS Score-6||MEDIUM
EPSS-0.05% / 14.65%
||
7 Day CHG~0.00%
Published-25 Feb, 2025 | 19:49
Updated-04 Mar, 2025 | 17:22
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Zoom Apps for macOS - Uncontrolled Resource Consumption

Uncontrolled resource consumption in the installer for some Zoom apps for macOS before version 6.1.5 may allow a privileged user to conduct a disclosure of information via local access.

Action-Not Available
Vendor-Zoom Communications, Inc.
Product-roomsmeeting_software_development_kitvideo_software_development_kitworkplace_desktopZoom Apps for macOS
CWE ID-CWE-708
Incorrect Ownership Assignment
CVE-2023-28603
Matching Score-6
Assigner-Zoom Video Communications, Inc.
ShareView Details
Matching Score-6
Assigner-Zoom Video Communications, Inc.
CVSS Score-7.7||HIGH
EPSS-0.02% / 5.38%
||
7 Day CHG~0.00%
Published-13 Jun, 2023 | 17:34
Updated-02 Jan, 2025 | 20:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.

Action-Not Available
Vendor-Microsoft CorporationZoom Communications, Inc.
Product-windowsvirtual_desktop_infrastructureZoom VDI Windows Meeting Client
CWE ID-CWE-73
External Control of File Name or Path
CVE-2025-64739
Matching Score-6
Assigner-Zoom Communications, Inc.
ShareView Details
Matching Score-6
Assigner-Zoom Communications, Inc.
CVSS Score-4.3||MEDIUM
EPSS-0.07% / 21.91%
||
7 Day CHG~0.00%
Published-13 Nov, 2025 | 14:28
Updated-13 Jan, 2026 | 20:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Zoom Clients - External Control of File Name or Path

External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.

Action-Not Available
Vendor-Zoom Communications, Inc.
Product-workplace_virtual_desktop_infrastructureworkplace_desktopmeeting_software_development_kitrooms_controllerroomsZoom Clients
CWE ID-CWE-73
External Control of File Name or Path
CVE-2024-0849
Matching Score-4
Assigner-Fluid Attacks
ShareView Details
Matching Score-4
Assigner-Fluid Attacks
CVSS Score-5||MEDIUM
EPSS-0.02% / 5.19%
||
7 Day CHG~0.00%
Published-07 Feb, 2024 | 02:50
Updated-19 May, 2025 | 17:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Leanote 2.7.0 - Local File Read

Leanote version 2.7.0 allows obtaining arbitrary local files. This is possible because the application is vulnerable to LFR.

Action-Not Available
Vendor-leanoteLeanote
Product-desktopLeanote
CWE ID-CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE ID-CWE-73
External Control of File Name or Path
CVE-2025-53769
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.10% / 26.56%
||
7 Day CHG~0.00%
Published-12 Aug, 2025 | 17:10
Updated-13 Feb, 2026 | 18:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Windows Security App Spoofing Vulnerability

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_security_appWindows Security App
CWE ID-CWE-73
External Control of File Name or Path
CVE-2025-47956
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-5.5||MEDIUM
EPSS-0.17% / 37.70%
||
7 Day CHG+0.01%
Published-10 Jun, 2025 | 17:02
Updated-13 Feb, 2026 | 19:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Windows Security App Spoofing Vulnerability

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.

Action-Not Available
Vendor-Microsoft Corporation
Product-windows_security_appWindows Security App
CWE ID-CWE-73
External Control of File Name or Path
Details not found