CVE-2025-0147 is a high severity (CVSS 8.8) type confusion bug in the Zoom Workplace app for Linux before version 6.2.10. The Zoom Meeting SDK and Video SDK for Linux are also affected before 6.2.10. Zoom advises applying the latest update, so move to 6.2.10 or later.
What's affected
Zoom security bulletin ZSB-25006, first published on 14 January 2025, lists three affected products: Zoom Workplace App for Linux before version 6.2.10, Zoom Meeting SDK for Linux before version 6.2.10, and Zoom Video SDK for Linux before version 6.2.10. The NVD record also names the desktop client and both SDKs.
The description says that type confusion may allow an authorized user to conduct an escalation of privilege via network access. The bulletin rates it High with a score of 8.8, and the vector requires user interaction. It credits the report to a researcher using the handle nahamsec.
The fix is in version 6.2.10 and later. Zoom says users can stay secure by applying the latest updates from its download page.
How to check if you're exposed
Check the installed version on each Linux machine.
- Open the Zoom app, click your profile picture, then open About Zoom Workplace or Settings to read the version.
- On Debian or Ubuntu systems where Zoom was installed from the .deb package, run the following.
dpkg -l | grep -i zoom
- On RPM based systems, use the rpm query command for the zoom package.
- If your product embeds the Meeting SDK or Video SDK for Linux, check the SDK version in your build files or dependency list. Those SDKs have their own release cycle, so an app update does not change them.
What to do now
- Update the Zoom Workplace app on Linux machines to 6.2.10 or later.
- Update embedded Meeting SDK and Video SDK for Linux builds to 6.2.10 or later and ship a new build of your product.
- Confirm versions on a sample of machines after the roll out.
- Turn on automatic updates if your policy allows it.
- Remove Zoom from Linux servers and build hosts that do not need a meeting client.
- Add the SDK versions to your software inventory so the next bulletin is easy to check.
Why it matters
Type confusion happens when a program treats a piece of memory as one kind of object when it is really another. The program then reads or writes in the wrong layout, which can corrupt memory in ways an attacker can shape. The class is access of a resource using an incompatible type.
Meeting software parses a lot of data from other people, such as messages, media and shared content, so it is a natural place for this kind of bug. Prompt updates matter more for such tools than for most apps. Embedded SDKs need extra attention, because the vulnerable code travels inside your own product and only a rebuild fixes it.
The weakness class is CWE-843: Access of Resource Using Incompatible Type. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which scores 8.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Are the SDKs affected too?
Yes. The bulletin lists the Meeting SDK for Linux and the Video SDK for Linux before 6.2.10.
Which version fixes it?
6.2.10 or later.
Sources
Last reviewed: 19 October 2026.
