CVE-2025-62484 is a high severity (CVSS 8.1) flaw in Zoom Workplace clients and the Zoom Meeting SDK, caused by inefficient regular expression complexity (CWE-1333). Zoom lists iOS and Android builds before 6.5.10 as affected. Update to 6.5.10 or later.
What's affected
Per Zoom bulletin ZSB-25048, published 11 November 2025, the affected products are:
- Zoom Workplace for iOS before version 6.5.10
- Zoom Workplace for Android before version 6.5.10
- Zoom Meeting SDK for iOS before version 6.5.10
- Zoom Meeting SDK for Android before version 6.5.10
The fixed version is 6.5.10. The bulletin credits the report to a researcher using the handle shmoul. Zoom describes the impact as an escalation of privilege by an unauthenticated user over the network. The CVSS vector is network reachable, low complexity, no privileges, with user interaction required.
How to check if you're exposed
For employees and managed devices, check the Zoom app version on each platform. In the app, open Settings and look for the About or version entry, then compare it with 6.5.10. Mobile device management tools can report installed app versions in bulk, so ask your MDM for every device running Zoom Workplace below 6.5.10.
For developers, the Meeting SDK is the part that hides inside your own products. Search your mobile projects for the SDK and its pinned version. For an Android project using Gradle, this lists resolved dependencies:
./gradlew app:dependencies | grep -i zoom
For iOS, look in the Podfile.lock or the Swift Package resolved file for the Zoom SDK version. If your app ships the SDK, your customers stay exposed until you release a build that bundles the fixed version.
What to do now
- Update Zoom Workplace on iOS and Android to 6.5.10 or later, using the app stores or your MDM.
- Ask your MDM or endpoint tool for a list of devices still below 6.5.10 and chase them.
- If you ship the Zoom Meeting SDK in your own mobile app, bump it to 6.5.10 or later and release a new build.
- Search your repositories for the SDK in every mobile project, including older apps that are rarely touched.
- Read bulletin ZSB-25048 for any later revision before closing the ticket.
Why it matters
A regular expression can take a very long time on certain inputs when its pattern allows many ways to match the same text. This is the weakness behind CWE-1333, often called ReDoS. A short crafted string can tie up the code that evaluates it.
Zoom words the impact as privilege escalation rather than a plain slowdown, and I did not find more technical detail in the bulletin, so I will not guess at the exact path. The practical reading is simple. Mobile clients that parse content from the network need the update, and so do products that embed the SDK.
The record does not mark this CVE as CISA Known Exploited, and the bulletin does not state exploitation.
Try it yourself
An SDK buried inside a mobile app is easy to forget. This demo shows how a dependency inventory surfaces the components you ship.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect the Zoom desktop clients?
The bulletin lists only the iOS and Android clients and the iOS and Android Meeting SDKs. The record text says "certain Zoom Workplace Clients," so confirm against the bulletin before assuming desktop is clear.
I only use Zoom, I do not build with it. Do I care about the SDK?
Only indirectly. Other apps you use may embed the SDK, and their vendors need to ship an update. For your own devices, updating Zoom Workplace to 6.5.10 or later covers the first party app.
Sources
Last reviewed: 18 October 2026.
