CVE-2025-46786: Zoom Meeting SDK XSS Vulnerability

CVE-2025-46786 Overview

CVE-2025-46786 is a cross-site scripting (XSS) vulnerability affecting multiple Zoom Workplace applications, including Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, and the Zoom Meeting Software Development Kit (SDK). The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and allows an authenticated user to impact application integrity through network access. Exploitation requires user interaction and results in a scope change, meaning injected content can affect resources beyond the initially vulnerable component. Zoom addressed the issue in security bulletin ZSB-25022.

Critical Impact
An authenticated attacker can inject malicious scripts into Zoom Workplace apps to compromise app integrity and access limited confidential information across affected desktop, mobile, and virtual desktop clients.

Affected Products

Zoom Meeting Software Development Kit (Android, iOS, Linux, macOS, Windows)
Zoom Workplace and Zoom Workplace Desktop (Android, iOS, Linux, macOS, Windows)
Zoom Rooms, Zoom Rooms Controller, and Zoom Workplace Virtual Desktop Infrastructure (Windows)

Discovery Timeline

2025-05-14 - CVE-2025-46786 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46786

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-controllable input rendered within Zoom Workplace client interfaces. An authenticated user can craft input containing script content that the client fails to sanitize before rendering. When another user interacts with the malicious content, the injected script executes within the trust context of the Zoom Workplace app.

The scope change indicator in the CVSS vector shows that successful exploitation extends beyond the initial vulnerable component. Injected scripts can read or modify limited data across app boundaries, undermining application integrity. Because the flaw exists in the client-side rendering path, it affects every platform on which the shared Workplace components run, spanning desktop, mobile, and VDI deployments.

Root Cause

The root cause is missing or insufficient output encoding on data displayed inside the Zoom Workplace app UI. Untrusted input reaches an HTML or JavaScript rendering context without appropriate context-aware escaping. This aligns with [CWE-79], where input reflected into web content is not neutralized before it is interpreted by the client's embedded rendering engine.

Attack Vector

An authenticated attacker delivers crafted content, likely through in-app messaging, meeting artifacts, or shared metadata surfaces exposed by the Workplace apps. A victim user must interact with the malicious content for the script to execute. Once triggered, the payload runs inside the app's rendering context and can tamper with UI elements, exfiltrate limited data visible to the client, or manipulate application state accessible to the current user session. No exploit code or public proof-of-concept has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-46786

Indicators of Compromise

Zoom Workplace client versions predating the fixes listed in Zoom bulletin ZSB-25022 running on managed endpoints.
Unusual outbound network requests from Zoom Workplace processes to domains not associated with Zoom infrastructure.
Unexpected renderer or subprocess crashes tied to Zoom clients during in-app content interaction.

Detection Strategies

Inventory installed Zoom Workplace, Zoom Rooms, Zoom Rooms Controller, and Zoom Meeting SDK versions across all supported platforms and compare against fixed builds in ZSB-25022.
Monitor endpoint telemetry for Zoom client processes spawning unexpected child processes or performing script-driven network activity.
Review meeting chat, in-app messages, and shared content logs (where available through Zoom admin tooling) for HTML or JavaScript-like payloads submitted by authenticated users.

Monitoring Recommendations

Enable endpoint detection and response telemetry on all systems running Zoom Workplace clients to capture process, network, and child-process activity.
Track patch compliance for Zoom Workplace apps as part of routine vulnerability management reporting.
Alert on Zoom client outbound connections to domains that are not part of Zoom's published network ranges.

How to Mitigate CVE-2025-46786

Immediate Actions Required

Update all Zoom Workplace, Workplace Desktop, Workplace VDI, Rooms, Rooms Controller, and Meeting SDK installations to the versions listed as fixed in Zoom Security Bulletin ZSB-25022.
Prioritize patching for shared and high-exposure systems such as Zoom Rooms devices, VDI images, and executive endpoints.
Verify that automatic updates are enabled for Zoom clients where organizational policy permits.

Patch Information

Zoom has released fixed versions across all affected platforms. Refer to Zoom Security Bulletin ZSB-25022 for the specific fixed build numbers per product and platform. Administrators managing Zoom deployments through MDM, SCCM, Intune, or Jamf should push the updated packages to enrolled endpoints and confirm installation through their management console.

Workarounds

No official workaround is documented by Zoom; updating to the fixed builds is the required remediation path.
Restrict Zoom meeting and chat participation to trusted internal users where feasible until patches are deployed.
Enforce user awareness guidance to avoid interacting with unexpected in-app content from unknown participants.

bash

# Example: verify installed Zoom Workplace version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX" /v DisplayVersion

# Example: verify installed Zoom version on macOS
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString