CVE-2025-64739 is a vulnerability classified under CWE-73, which pertains to external control of file name or path. This flaw exists in certain versions of Zoom Clients, a widely used video conferencing software by Zoom Communications Inc. The vulnerability allows an unauthenticated attacker to influence file path or file name parameters externally, potentially leading to unauthorized disclosure of information via network access. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N), but it does require user interaction (UI:R). The scope is unchanged (S:U), and the impact affects confidentiality only (C:L), with no impact on integrity or availability. This means an attacker could trick a user into triggering the vulnerability, causing sensitive information to be disclosed without altering or disrupting the system. Although no public exploits are known at this time, the vulnerability poses a risk particularly in environments where Zoom is used extensively for sensitive communications. The lack of available patches at the time of reporting necessitates proactive mitigation strategies. The vulnerability highlights the risk of improper handling of file path inputs, which can be exploited to access unintended files or data. Given Zoom’s widespread adoption, this vulnerability could have broad implications if exploited.

For European organizations, the primary impact is the potential unauthorized disclosure of sensitive information through manipulated file paths in Zoom Clients. This could lead to leakage of confidential business communications, personal data, or proprietary information, undermining privacy and compliance with regulations such as GDPR. Sectors like finance, healthcare, government, and critical infrastructure that rely heavily on Zoom for remote collaboration are particularly vulnerable. The medium severity reflects limited impact on system integrity or availability but highlights confidentiality risks that could facilitate further attacks or espionage. The requirement for user interaction reduces the likelihood of automated exploitation but does not eliminate risk, especially in targeted phishing or social engineering campaigns. The absence of known exploits currently limits immediate threat but vigilance is necessary as attackers may develop techniques to leverage this vulnerability. Overall, the vulnerability could erode trust in communication security and expose organizations to regulatory penalties if personal data is compromised.

1. Monitor Zoom Communications Inc. advisories closely and apply security patches immediately once released to address CVE-2025-64739. 2. Until patches are available, restrict or sanitize inputs related to file paths within Zoom Clients through endpoint security controls or application whitelisting. 3. Educate users to be cautious about unexpected prompts or file-related interactions during Zoom sessions to reduce risk of user interaction exploitation. 4. Implement network monitoring to detect unusual file access or data exfiltration patterns originating from Zoom Client processes. 5. Employ Data Loss Prevention (DLP) solutions to identify and block unauthorized disclosure of sensitive information. 6. Review and tighten Zoom Client configuration settings to minimize exposure of file system resources. 7. Coordinate with IT and security teams to conduct vulnerability scanning and penetration testing focused on Zoom Client deployments. 8. Consider alternative secure communication platforms temporarily if patching is delayed and risk is deemed unacceptable. 9. Maintain robust incident response plans to quickly address any exploitation attempts. These steps go beyond generic advice by focusing on proactive user training, network-level detection, and configuration hardening specific to Zoom Clients.