CVE-2025-64741 is a high severity (CVSS 8.1) improper authorization flaw in Zoom Workplace for Android and the Zoom Meeting SDK for Android. Both are affected before version 6.5.10. Zoom says an unauthenticated user could escalate privileges over the network. Update the app, and rebuild any app that embeds the SDK.
What's affected
Zoom's security bulletin ZSB-25043 lists two products. Zoom Workplace for Android before version 6.5.10, and Zoom Meeting SDK for Android before version 6.5.10. The NVD record names the same two products and the same cutoff.
The record and the bulletin agree on severity. Zoom rates it High with a CVSS score of 8.1, and the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. In plain terms, the attack is over the network, needs no account, and needs some user interaction. Confidentiality and integrity are rated high, and availability is not affected.
The wording is short. The bulletin describes improper authorization handling that may allow an unauthenticated user to conduct an escalation of privilege via network access. It does not give further technical detail, and I will not guess at it. The bulletin credits the report to a researcher at Microsoft and shows an initial publication date of 11 November 2025.
How to check if you're exposed
For the Zoom Workplace app, check the version on the device. In Android settings, open the app info for Zoom Workplace and read the version. For managed devices, ask your mobile device management tool for an inventory of installed app versions and filter for anything below 6.5.10.
From a connected test device you can also list the installed version with the Android debug bridge:
adb shell pm list packages | grep -i zoom
adb shell dumpsys package <package-name> | grep versionName
Replace the package name with the one the first command prints.
For developers, the SDK is a dependency of your own app. Look in your build files and your dependency tree for the Zoom Meeting SDK, and check which version you ship. If your app was built against a version before 6.5.10, users stay exposed until you release a new build, even if their Zoom Workplace app is current.
What to do now
- Update Zoom Workplace for Android to 6.5.10 or later through the store or your mobile device management tool.
- If you build an app with the Zoom Meeting SDK for Android, upgrade the SDK to 6.5.10 or later, test, and ship a new release.
- For managed fleets, set a compliance rule that flags Zoom builds below 6.5.10.
- Tell users of your own SDK based apps to update when your release is out.
- Check the bulletin page for later revisions, since vendors sometimes update guidance.
Why it matters
The record lists CWE-74 for this CVE, a broad injection class, while the description speaks of improper authorization. The CWE labels and the text do not line up perfectly, which happens with vendor-reported CVEs. What matters for a defender is the version cutoff and the fix, and both are clear.
Two things make SDK flaws awkward. First, the fix depends on every app builder who ships the SDK, not on one vendor update. Second, many teams cannot see which of their mobile apps embed which version of a third party SDK. A software inventory for mobile builds closes that gap. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one. The record does not flag this CVE as exploited in the wild, and it is not in the CISA catalog.
Quick check
Do I need to update if I only use the Zoom desktop client?
The bulletin lists only the Android Workplace app and the Android Meeting SDK. Desktop clients are not named, but you should still keep them current.
Is CVE-2025-64741 exploited in the wild?
Neither the record nor the bulletin says so, and the record's KEV flag is false.
Sources
Last reviewed: 18 October 2026.
