CVE-2025-49460: 
Zoom Client vulnerability analysis and mitigation

CVE-2025-49460 is an argument injection vulnerability (also described as uncontrolled resource consumption) in certain Zoom Workplace Clients that allows an unauthenticated remote attacker to conduct a denial of service via network access. It was published on September 9, 2025, by Zoom under security bulletin ZSB-25033. Affected products include Zoom Workplace Desktop (Windows, macOS, Linux), Zoom Rooms (Windows, macOS, Android, iPadOS), Zoom Rooms Controller (Windows, macOS, Linux, Android), Zoom Meeting SDK (Windows, macOS, Linux, Android), Zoom Workplace for iOS, and Zoom Workplace Virtual Desktop Infrastructure (Windows) — all versions prior to 6.5.0 (VDI prior to 6.3.14 or 6.4.12). The vulnerability carries a CVSS v3.1 base score of 7.5 (High) per NVD, though ENISA's EUVD rates it 4.3 (Medium) using a different vector (Zoom Advisory, Zoom Bulletin).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and involves argument injection in the network-facing components of Zoom Workplace Clients. An unauthenticated attacker can send specially crafted network requests that inject malicious arguments, causing the client to consume excessive resources and become unresponsive. No user interaction or authentication is required, and the attack vector is entirely network-based with low complexity. No public proof-of-concept code or detailed technical write-up has been identified at this time (Zoom Advisory, Zoom Bulletin).

Successful exploitation results in a denial of service condition affecting the availability of the Zoom Workplace Client on the targeted system. There is no impact on confidentiality or integrity — the vulnerability is limited to availability (CVSS A:H). Affected users would experience application crashes or unresponsiveness, disrupting communications and collaboration workflows, but no data exfiltration or code execution is expected (Zoom Advisory).

Zoom has released patched versions addressing this vulnerability. Users should update to Zoom Workplace Desktop, Rooms, Rooms Controller, Meeting SDK, and Workplace (iOS) version 6.5.0 or later; Zoom Workplace VDI for Windows should be updated to 6.3.14 (for the 6.3.x branch) or 6.4.12 (for the 6.4.x branch) or later. Updates are available via the official Zoom download page at https://zoom.us/download. No configuration-based workaround has been published; upgrading is the recommended remediation (Zoom Advisory, Zoom Bulletin).

Coverage of CVE-2025-49460 was limited to routine security news aggregation. CyberSecurityNews and CyberPress reported on Zoom's September 2025 security update batch, noting the release of multiple patches. No notable researcher commentary, vendor statements beyond the official bulletin, or significant social media discussion has been identified for this specific CVE.