Zoom CVE-2025-46788

The risk profile presents contradictory signals requiring careful analysis: (1) CVSS 7.4 indicates high severity with complete confidentiality impact (C:H) and high integrity impact (I:H), suggesting significant real-world harm potential; (2) However, attack vector is Network (AV:N) but Attack Complexity is High (AC:H), meaning exploitation requires non-trivial conditions such as network positioning, specific certificate configuration, or user actions; (3) No privileges required (PR:N) and no user interaction (UI:N) are favorable for attackers; (4) The lack of KEV status and unknown EPSS score suggest either recent disclosure or limited real-world exploitation. SSVC framework assessment: this vulnerability appears to have standard technical impact (information disclosure via MITM), likely automatable given proper network positioning, but exploitation status is unclear. The AC:H component significantly reduces practical risk compared to AC:L vulnerabilities. This should be treated as a moderate-to-high priority issue for Zoom Workplace on Linux deployments in environments with network threat models, but not a critical emergency. Organizations should patch within normal maintenance windows rather than emergency protocols.

An attacker positioned on a network segment (corporate LAN, compromised ISP, rogue WiFi access point, or BGP hijacking) intercepts traffic from a user running vulnerable Zoom Workplace for Linux version 6.4.13 or earlier. The attacker deploys a reverse proxy or certificate substitution attack, presenting a self-signed or attacker-controlled certificate for Zoom's communication endpoints. Due to improper certificate validation in the vulnerable client, the certificate is accepted without proper hostname or CA chain verification. The Zoom client establishes an encrypted tunnel with the attacker's proxy instead of the legitimate Zoom servers. The attacker can now: (1) capture and decrypt meeting credentials, tokens, or session data; (2) inject malicious content into video/audio streams; (3) exfiltrate personal or organizational information from meetings; (4) harvest authentication tokens for lateral movement. The high attack complexity suggests the attacker must either have sustained network positioning (AC:H implies not all network positions are sufficient) or specific knowledge of the certificate validation flaw. No public POC is referenced, but the vulnerability is likely discoverable through reverse engineering of the Linux client binary. This scenario is most credible in corporate BYOD environments, untrusted network scenarios, or targeted attacks against high-value users.