A critical denial-of-service vulnerability in BigBlueButton allows authenticated users to disrupt meeting chat functionality, necessitating an immediate update to version 3.0.13.

This flaw, categorized as CWE-703, involves the improper handling of exceptional conditions within the GraphQL mutation chatSendMessageReaction. An authenticated user can trigger a crash of the chat service for all meeting participants by supplying a specifically malformed reactionEmojiId parameter.

The ability to remotely crash core meeting features poses a significant risk to organizational productivity and communication continuity. While the vulnerability requires authentication, the ease of exploitation within a virtual classroom or meeting environment could lead to widespread service disruption, hindering collaborative workflows and potentially causing reputational damage. The CVSS score of 7.5 reflects the high impact on availability for affected communication sessions.

Immediate Action: Update BigBlueButton to version 3.0.13 or later to incorporate the vendor-supplied patch.

Proactive Monitoring: Monitor server logs for repeated GraphQL mutation errors or sudden, unexplained failures of the chat service during active meetings.

Compensating Controls: Implement rate limiting on GraphQL endpoints via an API gateway or Web Application Firewall (WAF) to mitigate the impact of malformed requests, though these are secondary to patching.

Public Exploit Available: Unknown

Given the potential for service disruption and the availability of a patch, all administrators should prioritize upgrading BigBlueButton instances to version 3.0.13. Organizations relying on this platform for critical communications must treat this as a high-priority maintenance task to prevent intentional or accidental denial-of-service events.