The identified vulnerabilities come from improper memory management within Zoom’s applications and SDKs. CVE-2025-27440, a heap-based buffer overflow occurs when excessive data is written beyond allocated memory, Attackers can exploit this flaw by injecting specially crafted data packets into Zoom’s processing functions. This can overwrite critical memory areas, leading to arbitrary code execution. enabling remote code execution (RCE). CVE-2025-27439 A buffer underflow occurs when a program reads data before the start of an allocated buffer due to improper memory boundary checks. In Zoom, an incorrectly handled function allows an attacker to retrieve unintended memory contents. This could expose sensitive user information or cause the application to crash due to illegal memory access. CVE-2025-0151, A use-after-free (UAF) vulnerability occurs when a program continues to use a memory pointer after the memory has already been freed. In Zoom, a specific function does not properly clear references to freed memory, allowing attackers to manipulate or corrupt the program’s execution flow. CVE-2025-0150 is caused by an incorrect behavior order vulnerability, where program operations execute out of sequence and bypass security checks. In Zoom, this flaw occurs when authentication and access control mechanisms are improperly ordered, allowing unauthorized actions to be performed before necessary validations are completed.