Zoom 5.2.0 (42619.0804)

Here are recurring questions and related user issues concerning the security of Zoom:

1. What are the most recent critical security vulnerabilities in Zoom?

In March 2025, Zoom addressed multiple high-severity vulnerabilities, notably CVE-2025-27440 (heap-based buffer overflow), CVE-2025-27439 (buffer underflow), CVE-2025-0151 (use-after-free), and CVE-2025-0150 (incorrect behavior order in iOS Workplace Apps). These vulnerabilities could allow attackers to execute arbitrary code, escalate privileges, or access sensitive data. Zoom released patches in version 6.3.0. (Intrucept Labs, SecurityWeek)

2. Has Zoom experienced any major security breaches in the past?

Yes, Zoom has experienced significant security incidents. In April 2020, over 500,000 Zoom user credentials were found for sale on the dark web, resulting from credential stuffing attacks. In July 2019, a vulnerability allowed websites to forcibly activate a user’s camera without consent. Zoom addressed these promptly through updates and improved security measures. (Wikipedia)

3. What is 'Zoombombing,' and how has Zoom mitigated this issue?

'Zoombombing' refers to unauthorized users disrupting Zoom meetings with inappropriate content. This became particularly problematic during early 2020. Zoom mitigated this by enabling waiting rooms and passwords by default, and allowing hosts to lock meetings after all participants join, effectively reducing incidents.

4. Does Zoom use end-to-end encryption for its meetings?

Initially, Zoom inaccurately claimed to offer end-to-end encryption (E2EE). Following criticism, Zoom introduced true E2EE in October 2020. This feature significantly enhances meeting privacy but disables cloud recording and live transcription when activated.

5. Have there been any zero-click vulnerabilities in Zoom?

Yes, in November 2021, Google’s Project Zero researcher Natalie Silvanovich discovered zero-click vulnerabilities in Zoom, potentially allowing attackers to control victims' devices without user interaction. Zoom addressed these vulnerabilities quickly after discovery. (Wired)

6. What steps has Zoom taken to improve its security posture?

In response to security criticisms in 2020, Zoom launched a 90-day security improvement plan, halted feature development temporarily, hired security experts, initiated a bug bounty program, and introduced over 100 security-related enhancements, including improved encryption and robust meeting controls. (Wikipedia)

7. Where can users find information about Zoom's security updates?

Zoom provides detailed security updates through its dedicated Security Bulletin page, which lists recent vulnerabilities, their severity, impacted versions, and mitigation measures. Users are encouraged to regularly check and update their software accordingly. (Zoom Security Bulletin)