CVE-2025-49462: XSS in Zoom Clients

The primary impact of this XSS vulnerability is the potential for information disclosure. An attacker, having authenticated access to a Zoom client, could inject malicious scripts that, when executed by other users, could expose sensitive data. This could include session tokens, user credentials, or other confidential information transmitted over the network. While the CVSS score is LOW, the potential for data leakage, especially within organizations heavily reliant on Zoom for communication, warrants prompt remediation. The attack vector requires authentication, limiting the immediate scope, but successful exploitation could lead to further compromise if credentials are stolen.

1. Reserved2025-06-04
2. Published2025-07-10
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-49462 is to upgrade Zoom Clients to version 6.4.5 or later. If immediate upgrading is not feasible due to compatibility issues or testing requirements, consider implementing stricter input validation on user-supplied data within the Zoom client application. While a direct WAF rule is unlikely to be effective for this client-side vulnerability, reviewing Zoom client configurations for any unnecessary permissions or features could reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the XSS vulnerability using known attack vectors and verifying that the client properly sanitizes input.