CVE-2025-61601

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-703

Affected software

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 3.0.13

References

https://github.com/bigbluebutton/bigbluebutton/pull/23662Issue Tracking, Patch
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5Exploit, Vendor Advisory
https://www.youtube.com/watch?v=BwROSVIYjOYExploit
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5Exploit, Vendor Advisory
https://www.youtube.com/watch?v=BwROSVIYjOYExploit

Timeline

Published: Oct 9, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-616027.5BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authentica CVE-2025-616039.8WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in CVE-2025-616047.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilit CVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilit CVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-616097.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-61619.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown funct CVE-2025-616107.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition CVE-2025-616117.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilege CVE-2025-616127.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition