Security researchers have uncovered two significant vulnerabilities in Zoom Clients for Windows, exposing users to potential Denial of Service (DoS) attacks.
The flaws, identified as classic buffer overflow vulnerabilities, could allow an authorized user to disrupt Zoom services via network access.
Both issues have been assigned medium severity ratings, and Zoom has released updates to address the risks.
A buffer overflow occurs when a program writes more data to a buffer than it can hold. This can corrupt data, crash the application, or, in some cases, allow attackers to execute arbitrary code.
| CVE ID | CVSS Score | Severity | Affected Products & Versions |
| CVE-2025-49464 | 6.5 | Medium | – Zoom Workplace for Windows < 6.4.0 – Zoom Workplace VDI for Windows < 6.3.10 (except 6.1.7, 6.2.15) – Zoom Rooms for Windows < 6.4.0 – Zoom Rooms Controller for Windows < 6.4.0 – Zoom Meeting SDK for Windows < 6.4.0 |
| CVE-2025-46789 | 6.5 | Medium | – Zoom Workplace for Windows < 6.4.5 – Zoom Workplace VDI for Windows < 6.3.12 (except 6.2.15) – Zoom Rooms for Windows < 6.4.5 – Zoom Rooms Controller for Windows < 6.4.5 – Zoom Meeting SDK for Windows < 6.4.5 |
In the context of Zoom for Windows, these vulnerabilities could be exploited to trigger a DoS attack, rendering the service unavailable to legitimate users.
Both vulnerabilities were reported by the security researcher known as “fre3dm4n” and were disclosed in security bulletins ZSB-25028 and ZSB-25024. The initial publication date for both was July 8, 2025.
Impacted Products
The vulnerabilities affect a range of Zoom products for Windows, including:
Zoom recommends all users and administrators update their Windows clients to the latest versions available at the official Zoom download page.
Applying these updates will address the vulnerabilities and help prevent potential DoS attacks.
While the vulnerabilities require an authorized user to exploit, the potential impact on business continuity and communication is significant.
Organizations relying on Zoom for critical operations should prioritize patching affected systems.
The swift response from Zoom and the responsible disclosure by the researcher demonstrate the importance of ongoing vigilance in software security.
Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…