CVE-2025-49461: Zoom Meeting SDK XSS Vulnerability

CVE-2025-49461 Overview

CVE-2025-49461 is a cross-site scripting (XSS) vulnerability affecting multiple Zoom Workplace Client products. An unauthenticated remote attacker can exploit improper input neutralization to trigger a denial of service condition against the client. The flaw is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation. Successful exploitation requires user interaction but no privileges, and the impact crosses a trust boundary affecting client availability. Zoom disclosed the issue in security bulletin ZSB-25034.

Critical Impact
An unauthenticated attacker with network access can crash Zoom Workplace Clients across Windows, macOS, Linux, Android, iOS, and iPadOS, disrupting collaboration sessions and meeting availability.

Affected Products

Zoom Meeting Software Development Kit (Android, Linux, macOS, Windows)
Zoom Rooms and Zoom Rooms Controller (Android, iPadOS, Linux, macOS, Windows)
Zoom Workplace, Workplace Desktop, and Workplace VDI clients

Discovery Timeline

2025-09-09 - CVE-2025-49461 published to the National Vulnerability Database
2025-10-06 - Last updated in NVD database

Technical Details for CVE-2025-49461

Vulnerability Analysis

The vulnerability is a client-side cross-site scripting issue within embedded web rendering components of Zoom Workplace Clients. Zoom clients use embedded web views to render meeting content, chat messages, and collaboration features. When attacker-controlled input is processed without proper neutralization, injected script content executes in the rendering context. In this case, the injected payload triggers a denial of service rather than data theft, consistent with the scope-changed availability-only impact described by the vendor.

The scope change indicator suggests the injected content escapes the originating component and affects another part of the client, leading to client-wide instability or crash. Because no authentication is required and the attack is delivered over the network, any attacker capable of sending content rendered by the client can attempt exploitation. The user interaction requirement implies the victim must open, view, or join a session containing the malicious payload.

Root Cause

The root cause is improper neutralization of input during web page generation within client-rendered surfaces. Untrusted content is reflected or stored without adequate sanitization, allowing script execution in the client's web rendering context. The resulting script paths trigger conditions that crash or hang the client process.

Attack Vector

Exploitation requires an attacker to deliver crafted content to a Zoom Workplace Client over the network, such as through meeting metadata, chat input, or SDK-rendered content. The victim must interact with the malicious content by opening or rendering it inside the client. No prior authentication or account on the targeted system is required.

No public proof-of-concept or exploit code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Zoom Security Bulletin ZSB-25034 for vendor-specific technical details.

Detection Methods for CVE-2025-49461

Indicators of Compromise

Unexpected crashes, hangs, or restarts of Zoom Workplace, Zoom Rooms, or Zoom SDK-based applications after joining a meeting or receiving chat content
Crash dumps referencing Zoom client web rendering components or embedded browser modules
Outbound connections from Zoom client processes to unfamiliar meeting domains or relays preceding crashes

Detection Strategies

Monitor endpoint telemetry for repeated abnormal terminations of Zoom client binaries such as Zoom.exe, zoom.us, or ZoomRooms.exe
Correlate Zoom client crash events with recent inbound meeting invites, chat messages, or SDK content from external organizations
Inventory installed Zoom client versions across endpoints and flag any builds older than the fixed releases listed in ZSB-25034

Monitoring Recommendations

Centralize Windows Error Reporting and macOS crash logs to a SIEM or data lake for trend analysis
Alert on clusters of crash events affecting Zoom clients within short time windows across multiple users
Track Zoom client version inventory continuously to confirm patch coverage across managed endpoints

How to Mitigate CVE-2025-49461

Immediate Actions Required

Update all Zoom Workplace Clients, Zoom Rooms, Zoom Rooms Controller, and Zoom Meeting SDK installations to the versions listed in ZSB-25034
Enforce automatic updates for Zoom desktop and mobile clients through endpoint management policies
Audit applications that embed the Zoom Meeting SDK and rebuild them against patched SDK versions

Patch Information

Zoom has released fixed versions for affected clients. Administrators should consult Zoom Security Bulletin ZSB-25034 for the specific fixed versions per platform and ensure all Workplace, Rooms, Rooms Controller, and Meeting SDK builds are updated.

Workarounds

Restrict meeting participation and chat from external or unauthenticated users where business requirements allow
Disable or restrict third-party SDK-embedded clients until they are rebuilt with the patched Meeting SDK
Limit Zoom Rooms and Rooms Controller exposure to trusted internal networks and managed devices

bash

# Configuration example: verify installed Zoom client version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Zoom\ZoomUpdater" /v DisplayVersion
# On macOS
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString