CVE-2025-49462: 
NixOS vulnerability analysis and mitigation

CVE-2025-49462 is a cross-site scripting (XSS) vulnerability affecting certain Zoom Clients before version 6.4.5, which may allow an authenticated user to conduct information disclosure via network access. The vulnerability was disclosed by Zoom on July 8, 2025, and published to NVD on July 10, 2025. It affects Zoom clients across all major platforms including Windows, macOS, Linux, iOS, and Android. It carries a CVSS v3.1 base score of 3.5 (Low) (Zoom Advisory).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery) per Feedly's analysis, though the vendor describes it as a cross-site scripting (XSS) issue. Exploitation requires the attacker to be an authenticated user and requires user interaction, with the attack delivered over the network. The flaw exists in Zoom Clients prior to version 6.4.5 across all supported platforms (Windows, macOS, Linux, iOS, Android), and successful exploitation is limited to confidentiality impact with no integrity or availability consequences (Zoom Advisory).

Successful exploitation of this vulnerability may result in limited information disclosure. Because the CVSS score reflects no integrity or availability impact and a low confidentiality impact with unchanged scope, the practical consequence is restricted to an attacker potentially accessing sensitive data visible within the Zoom client context. Lateral movement or significant data exfiltration is unlikely given the constrained impact scope (Zoom Advisory).

There is no known public proof-of-concept exploit code or evidence of in-the-wild exploitation for CVE-2025-49462 at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014%, indicating a very low probability of exploitation in the near term (Zoom Advisory).

Zoom has released version 6.4.5 of the Zoom Client for all affected platforms (Windows, macOS, Linux, iOS, and Android) to address this vulnerability. Users should update to version 6.4.5 or later via the official Zoom download page at https://zoom.us/download. No configuration-based workarounds have been published; upgrading is the recommended remediation (Zoom Advisory).

Security news outlet SecurityOnline.info covered this vulnerability as part of a broader report on Zoom patching six flaws including DoS, information disclosure, and XSS issues across all platforms (SecurityOnline). Community reaction has been minimal given the low CVSS score and limited exploitation potential, with no notable researcher commentary or significant social media discussion identified beyond routine CVE tracking.