CVE-2025-30662

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-646

Affected software

No affected versions have been published.

Timeline

Published
Nov 13, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-306637.0Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege vCVE-2025-306648.2Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2025-306656.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306666.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306676.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306686.5Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.CVE-2025-306696.5Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacenCVE-2025-30678.8Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a useCVE-2025-306706.5Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306716.5Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306726.5Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If aCVE-2025-306736.5Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-123
CVE-2025-30662: Medium severity, CVSS 6.5 | Vulnix