CVE-2025-46785
📋 TL;DR
A buffer over-read vulnerability in Zoom Workplace Apps for Windows allows authenticated users to cause denial of service through network access. This affects Zoom Workplace users on Windows systems with vulnerable versions installed. The vulnerability requires authentication but could disrupt service availability.
💻 Affected Systems
- Zoom Workplace Apps
📦 What is this software?
Rooms by Zoom
Workplace Virtual Desktop Infrastructure by Zoom
View all CVEs affecting Workplace Virtual Desktop Infrastructure →
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Zoom Workplace applications on affected systems, potentially requiring system restart to restore functionality.
Likely Case
Application crashes or instability affecting Zoom Workplace functionality for authenticated users.
If Mitigated
Minimal impact with proper network segmentation and authentication controls limiting exploit scope.
🎯 Exploit Status
Requires authenticated access and network connectivity to vulnerable system; buffer over-read vulnerabilities typically require specific conditions to trigger
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zoom security bulletin ZSB-25021 for patched versions
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25021
Restart Required: Yes
Instructions:
1. Visit Zoom security bulletin ZSB-25021
2. Identify patched version for your Zoom Workplace Apps
3. Update Zoom Workplace Apps through official update mechanism
4. Restart affected systems after update
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to Zoom Workplace services to trusted users only
Authentication Controls
allImplement strict authentication requirements and monitor for suspicious authenticated sessions
🧯 If You Can't Patch
- Implement network segmentation to isolate Zoom Workplace systems from untrusted networks
- Monitor for application crashes or unusual Zoom Workplace behavior indicating potential exploitation
🔍 How to Verify
Check if Vulnerable:
Check Zoom Workplace Apps version against affected versions listed in ZSB-25021 security bulletinCheck Version:
In Zoom Workplace Apps: Help > About or check application propertiesVerify Fix Applied:
Verify Zoom Workplace Apps version matches or exceeds patched version from ZSB-25021📡 Detection & Monitoring
Log Indicators:
- Zoom Workplace application crashes
- Unexpected termination of Zoom processes
- Access violations in application logs
Network Indicators:
- Unusual network patterns to Zoom services from authenticated users
- Multiple connection attempts followed by service disruption
SIEM Query:
source="zoom" AND (event="crash" OR event="termination" OR severity="critical")