OpenSSL DLLs (3.4.2.0) triggering Defender alerts for CVE-2025-9230, 9231, 9232

Meeting SDK Windows
1

I am reporting that Microsoft Defender for Endpoint is currently flagging the bundled OpenSSL libraries in the Zoom binary folder as critical vulnerabilities.

The specific files affected are:

  • C:\Program Files\zoom\bin\libcrypto-3-zm.dll (Version 3.4.2.0)

  • C:\Program Files\zoom\bin\libssl-3-zm.dll (Version 3.4.2.0)

Associated CVEs According to the security portal, these files are being flagged for the following vulnerabilities:

  • CVE-2025-9230

  • CVE-2025-9231

  • CVE-2025-9232

Is the Zoom engineering team aware that these specific CVEs are triggering alerts for version 3.4.2.0? We need to know if there is an upcoming action or patch to address these vulnerability flags, as they are impacting our enterprise security compliance.

1 Like
2

I can confirm that we are facing the same issue and impact to compliance.
The fixed version of OpenSSL, 3.4.3 was released September 30, 2025. Can we please get this updated?

1 Like