Recently, two vulnerabilities have been discovered in specific Zoom Clients for Windows, which could enable attackers to launch Denial of Service (DoS) attacks. The vulnerabilities impact multiple Zoom products for Windows, with slight variations in affected versions between the two CVEs. Both vulnerabilities stem from a classic buffer overflow issue in the affected Zoom products. While the attack requires low privileges and no user interaction, the potential for disruption is significant for organizations relying on Zoom for communication. For Zoom users, particularly those managing large teams or sensitive operations, staying vigilant about software updates is essential. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. These vulnerabilities highlight the ongoing challenges in securing widely used communication tools, especially as remote work and virtual meetings remain integral to many organizations. These flaws, tracked under CVE-2025-49464 and CVE-2025-46789, were reported by security researcher fre3dm4n and carry a Medium severity rating with a CVSS score of 6.5 each. The CVSS vector string for both issues, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicates a high impact on availability, though confidentiality and integrity remain unaffected. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. This flaw could enable an authorized user with network access to exploit the system, causing a DoS condition that disrupts service availability. Zoom has acknowledged these vulnerabilities and released updates to address them. Ensuring that software is up to date is a critical step in safeguarding against potential exploits that could interrupt business operations or personal communications. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications. Buffer overflow issues, while classic, continue to pose risks when not addressed promptly.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 08 Jul 2025 17:35:12 +0000