Security researchers have uncovered two significant vulnerabilities in Zoom Clients for Windows, exposing users to potential Denial of Service (DoS) attacks.
The flaws, identified as classic buffer overflow vulnerabilities, could allow an authorized user to disrupt Zoom services via network access.
Both issues have been assigned medium severity ratings, and Zoom has released updates to address the risks.
A buffer overflow occurs when a program writes more data to a buffer than it can hold. This can corrupt data, crash the application, or, in some cases, allow attackers to execute arbitrary code.
| CVE ID | CVSS Score | Severity | Affected Products & Versions |
| CVE-2025-49464 | 6.5 | Medium | – Zoom Workplace for Windows < 6.4.0 – Zoom Workplace VDI for Windows < 6.3.10 (except 6.1.7, 6.2.15) – Zoom Rooms for Windows < 6.4.0 – Zoom Rooms Controller for Windows < 6.4.0 – Zoom Meeting SDK for Windows < 6.4.0 |
| CVE-2025-46789 | 6.5 | Medium | – Zoom Workplace for Windows < 6.4.5 – Zoom Workplace VDI for Windows < 6.3.12 (except 6.2.15) – Zoom Rooms for Windows < 6.4.5 – Zoom Rooms Controller for Windows < 6.4.5 – Zoom Meeting SDK for Windows < 6.4.5 |
In the context of Zoom for Windows, these vulnerabilities could be exploited to trigger a DoS attack, rendering the service unavailable to legitimate users.
Both vulnerabilities were reported by the security researcher known as “fre3dm4n” and were disclosed in security bulletins ZSB-25028 and ZSB-25024. The initial publication date for both was July 8, 2025.
Impacted Products
The vulnerabilities affect a range of Zoom products for Windows, including:
Zoom recommends all users and administrators update their Windows clients to the latest versions available at the official Zoom download page.
Applying these updates will address the vulnerabilities and help prevent potential DoS attacks.
While the vulnerabilities require an authorized user to exploit, the potential impact on business continuity and communication is significant.
Organizations relying on Zoom for critical operations should prioritize patching affected systems.
The swift response from Zoom and the responsible disclosure by the researcher demonstrate the importance of ongoing vigilance in software security.
Stay Updated on Daily Cybersecurity News . Follow us on Google News, LinkedIn, and X.
A long-running pay-per-install (PPI) operation that used YouTube gaming channels and SEO-poisoned software downloads to…
Two security vulnerabilities in VLC media player versions 3.0.0 through 3.0.23 could allow attackers to…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in MikroTik RouterOS…
A recently disclosed vulnerability in ConfigServer Security & Firewall (CSF) could allow unauthenticated remote attackers…
Threat actors are adapting malware not only for conventional endpoint defenses and sandboxes, but also…
GitLab has issued an emergency security update to address two critical vulnerabilities that could lead…