Description
Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.
Affected products
zoom: workplace virtual desktop infrastructure
References1
- www.zoom.com/en/trust/security-bulletin/zsb-25045 Vendor Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 3 · as of 11 November 2026
- CWE
- CWE-646
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.