CVE-2025-46789 Overview
CVE-2025-46789 is a classic buffer overflow vulnerability [CWE-120] affecting certain Zoom Clients for Windows. An authorized user can trigger the flaw over the network to cause a denial of service on the targeted client. The issue carries a medium severity rating with a CVSS v3.1 base score of 6.5. Zoom documented the vulnerability in Security Bulletin ZSB-25024 and released fixed client builds.
The weakness stems from improper restriction of operations within the bounds of a memory buffer. Successful exploitation disrupts availability of the Zoom client without exposing confidentiality or integrity of user data.
Critical Impact
Authenticated attackers with network access can crash Zoom Clients for Windows, interrupting meetings and client availability for affected users.
Affected Products
- Zoom Clients for Windows (per Zoom Security Bulletin ZSB-25024)
- CPE: cpe:2.3:a:zoom:zoom:-:*:*:*:*:windows:*:*
- Component: zoom:zoom
Discovery Timeline
- 2025-07-10 - CVE-2025-46789 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-46789
Vulnerability Analysis
The vulnerability is a classic buffer overflow in Zoom Clients for Windows. The client writes data to a fixed-length buffer without verifying that input length remains within allocated bounds. When an authorized user supplies crafted input over the network, the overflow corrupts adjacent memory and terminates the client process.
Because the CVSS vector reports no impact on confidentiality or integrity, the practical outcome is a denial of service rather than code execution. Exploitation requires valid authentication to Zoom services, which limits the attacker population to legitimate account holders.
Root Cause
The root cause maps to [CWE-120], Buffer Copy without Checking Size of Input. The vulnerable code path accepts attacker-controlled data from a network peer and copies it into a stack or heap buffer without enforcing the destination size. The resulting overwrite destabilizes process state and causes the Zoom client to crash.
Attack Vector
The attack vector is network-based and requires low privileges with no user interaction. An authenticated Zoom user sends a crafted message or protocol payload to another client. The oversized payload triggers the buffer overflow in the receiving Windows client and terminates its session.
No public proof-of-concept, exploit code, or evidence of exploitation in the wild has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. See the Zoom Security Bulletin ZSB-25024 for vendor technical details.
Detection Methods for CVE-2025-46789
Indicators of Compromise
- Unexpected termination or repeated crashes of the Zoom client process (Zoom.exe) on Windows endpoints.
- Windows Application event log entries referencing faulting module exceptions tied to the Zoom client binary.
- Watson or Windows Error Reporting (WER) crash dumps generated for the Zoom client around meeting activity.
Detection Strategies
- Correlate Zoom client crash events with inbound network sessions to Zoom infrastructure to identify DoS patterns.
- Monitor for clusters of simultaneous Zoom client crashes across multiple endpoints, which may indicate a targeted DoS attempt.
- Track Zoom client version telemetry and flag endpoints running builds predating the ZSB-25024 fix.
Monitoring Recommendations
- Ingest Windows Application and Reliability event logs into a central SIEM for crash analytics.
- Alert on repeated process termination of Zoom.exe with non-zero exit codes within short time windows.
- Review Zoom admin audit logs for unusual authenticated session activity directed at affected users.
How to Mitigate CVE-2025-46789
Immediate Actions Required
- Update all Zoom Clients for Windows to the fixed version listed in Zoom Security Bulletin ZSB-25024.
- Enable automatic updates for the Zoom client to shorten exposure windows for future advisories.
- Inventory endpoints with outdated Zoom installations and prioritize remediation on systems used for sensitive meetings.
Patch Information
Zoom addressed the buffer overflow in the client builds referenced in Security Bulletin ZSB-25024. Administrators should deploy the latest Zoom Client for Windows through their standard software distribution process. Verify installed versions after deployment to confirm the fix is present.
Workarounds
- Restrict Zoom meeting participation to known, authenticated users and limit external guest access where feasible.
- Enable waiting rooms and participant screening to reduce the pool of authorized attackers able to reach vulnerable clients.
- Remove or disable Zoom installations on endpoints that do not require the client until patching completes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
