CVE-2025-49461: 
Zoom Rooms vulnerability analysis and mitigation

CVE-2025-49461 is a Cross-Site Scripting (XSS) vulnerability in certain Zoom Workplace Clients that may allow an unauthenticated attacker to conduct a denial of service via network access. It was disclosed by Zoom on September 9, 2025, under security bulletin ZSB-25034. Affected products include Zoom Workplace Desktop (Windows, macOS, Linux) before version 6.5.0, Zoom Workplace for iOS before 6.5.0, Zoom Rooms (Windows, macOS, Android, iPadOS) before 6.5.0, Zoom Rooms Controller (Windows, macOS, Linux, Android) before 6.5.0, Zoom Meeting SDK (Windows, macOS, Linux, Android) before 6.5.0, and Zoom Workplace VDI for Windows before versions 6.3.14 and 6.4.12. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) (Zoom Advisory).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), where user-supplied input is not properly sanitized before being rendered in the client interface (Zoom Advisory). An unauthenticated attacker can deliver a malicious payload via network access, requiring user interaction (e.g., a victim opening or interacting with crafted content) to trigger the XSS condition. The scope is changed (S:C), meaning the impact extends beyond the vulnerable component itself, and the primary consequence is a denial of service affecting availability. No public proof-of-concept code or detailed technical write-ups have been identified at this time.

Successful exploitation results in a denial of service condition, with high availability impact and no direct confidentiality or integrity impact per the CVSS scoring (Zoom Advisory). The changed scope indicates the attack can affect components beyond the directly vulnerable Zoom client, potentially disrupting meeting sessions or client functionality for affected users. The vulnerability does not appear to enable data exfiltration or code execution based on current information.

No evidence of in-the-wild exploitation or active weaponization has been reported for CVE-2025-49461. The EPSS score is approximately 0.057%, indicating a very low probability of exploitation in the near term (Zoom Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution or exploit kits have been associated with this CVE.

Zoom has released patched versions addressing this vulnerability. Users should update to Zoom Workplace Desktop (Windows, macOS, Linux) version 6.5.0 or later, Zoom Workplace for iOS 6.5.0 or later, Zoom Rooms and Rooms Controller (all platforms) 6.5.0 or later, Zoom Meeting SDK (all platforms) 6.5.0 or later, and Zoom Workplace VDI for Windows version 6.3.14 or 6.4.12 or later (Zoom Advisory). Updates are available at https://zoom.us/download. No configuration-based workarounds have been published; upgrading to a patched version is the recommended remediation.

Coverage of this vulnerability was limited to routine security news outlets and aggregators. CyberSecurityNews and CyberPress reported on Zoom's September 2025 security update batch, which included this CVE among multiple fixes (Zoom Advisory). No notable researcher commentary or significant community discussion has been identified beyond standard vulnerability tracking and aggregation.