Cyber Resilience

CVE-2025-46788

High

Published: 10 July 2025

Published
10 July 2025
Modified
05 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0011 28.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-46788 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Zoom Workplace Desktop. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 28.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-8 (Transmission Confidentiality and Integrity) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-46788 is an improper certificate validation vulnerability affecting Zoom Workplace for Linux versions prior to 6.4.13. This flaw, classified under CWE-295, enables potential information disclosure through network access due to inadequate verification of certificates during communication. The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high confidentiality and integrity impacts with high attack complexity but no requirement for privileges or user interaction.

An attacker with network access to a vulnerable Zoom Workplace for Linux installation could exploit this issue to conduct information disclosure. By leveraging the improper certificate validation, an unauthorized user might intercept or manipulate communications, potentially exposing sensitive data and compromising the integrity of sessions without disrupting availability.

Zoom's security bulletin (ZSB-25023) at https://https://www.zoom.com/en/trust/security-bulletin/zsb-25023/ addresses this vulnerability, recommending an upgrade to Zoom Workplace for Linux version 6.4.13 or later as the primary mitigation to properly enforce certificate validation.

EU & UK References

Vulnerability details

Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to conduct an information disclosure via network access.

CWE(s)
CWE-295

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Why these techniques?

Improper certificate validation (CWE-295) directly enables an on-path attacker to perform adversary-in-the-middle interception or manipulation of Zoom traffic, matching T1557.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-30903Same product: Zoom Workplace Desktop
CVE-2026-30900Same product: Zoom Workplace Desktop
CVE-2025-0147Same product: Zoom Workplace Desktop
CVE-2026-30902Same product: Zoom Workplace Desktop
CVE-2024-31854Shared CWE-295
CVE-2024-47258Shared CWE-295
CVE-2026-32627Shared CWE-295
CVE-2024-55581Shared CWE-295
CVE-2024-45418Same product: Zoom Workplace Desktop
CVE-2025-11043Shared CWE-295

Affected Assets

zoom
workplace desktop
≤ 6.4.13

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-8 Transmission Confidentiality and Integrity good match
prevent

Directly requires cryptographic mechanisms that enforce transmission confidentiality and integrity, which proper certificate validation implements for Zoom network sessions.

SC-17 Public Key Infrastructure Certificates partial match
prevent

Addresses issuance and validation of PKI certificates used to authenticate Zoom endpoints and prevent man-in-the-middle information disclosure.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of software flaws such as the improper certificate validation in Zoom Workplace for Linux < 6.4.13.

References