CVE-2025-61602 BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId

What is CVE-2025-61602?

CVE-2025-61602 is a high-severity denial of service vulnerability in bigbluebutton, published on 9 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

BigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed `reactionEmojiId` in the GraphQL mutation `chatSendMessageReaction`. Version 3.0.13 contains a patch. No known workarounds are available.

Weakness: CWE-703

Which versions are affected by CVE-2025-61602?

It affects 1 product.

Products include Bigbluebutton Bigbluebutton.

How do I fix CVE-2025-61602?

No fix has been published for CVE-2025-61602 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-61602 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61602 exists.

Other vulnerabilities in bigbluebutton

• CVE-2020-27602 Other in n/a Critical 9.8
• CVE-2020-27605 Code injection in n/a Critical 9.8
• CVE-2020-12443 Path traversal in n/a Critical 9.8
• CVE-2020-27613 Hardcoded credentials in n/a High 8.4
• CVE-2021-4143 Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-45j2-m26c-3pcm.