Untrusted search path in Zoom Video Communications, Inc. products - CVE-2025-49457
Published: August 12, 2025
Vulnerability identifier: #VU113833
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-49457
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Zoom Video Communications, Inc.
Affected software:
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Zoom Rooms Controller for Windows
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Zoom Workplace Desktop App for Windows
Zoom Rooms Client for Windows
Zoom Rooms Controller for Windows
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.
How to mitigate CVE-2025-49457
Install updates from vendor's website.