CVE-2025-30664: Zoom SDK Privilege Escalation Vulnerability

CVE-2025-30664 Overview

CVE-2025-30664 is a cross-site scripting (XSS) vulnerability affecting multiple Zoom Workplace applications. An authenticated user with local access can inject script content that executes in a privileged context, leading to escalation of privilege. The flaw spans Zoom Workplace desktop and mobile clients, Zoom Rooms, Zoom Rooms Controller, the Zoom Meeting Software Development Kit (SDK), and Zoom Workplace Virtual Desktop Infrastructure (VDI) builds. Zoom assigned this issue [CWE-79] and published details in Zoom Security Bulletin ZSB-25017.

Critical Impact
A local authenticated user can escalate privileges by exploiting an XSS flaw across Zoom Workplace, Zoom Rooms, and the Meeting SDK, with a scope change that impacts confidentiality, integrity, and availability of the affected host.

Affected Products

Zoom Workplace and Zoom Workplace Desktop (Windows, macOS, Linux, Android, iOS)
Zoom Rooms and Zoom Rooms Controller (Windows, macOS, Android, Linux, iPadOS)
Zoom Meeting SDK and Zoom Workplace VDI (Windows)

Discovery Timeline

2025-05-14 - CVE-2025-30664 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30664

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting (XSS) weakness inside Zoom Workplace client components. Zoom Workplace apps render portions of user-controlled content through embedded web views. When that content is not properly encoded, script payloads execute inside the client process. Because the client runs with the interactive user's privileges and shares session context with other Zoom components, injected script can reach APIs or files outside the attacker's normal permission boundary.

Exploitation requires user interaction and local access, meaning the attacker must already have a foothold on the endpoint or coerce a signed-in user to trigger the crafted content. Successful exploitation crosses a security scope boundary and results in high impact to confidentiality, integrity, and availability of the host.

Root Cause

The root cause is improper neutralization of input during web page generation inside the Zoom client, classified as [CWE-79]. Content that should have been treated as data is instead parsed and executed as script within a WebView or embedded rendering surface.

Attack Vector

An authenticated user with local access supplies crafted input that another Zoom Workplace component subsequently renders. When the target user interacts with the affected view, the injected script executes with the privileges of the Zoom client, enabling privilege escalation on the endpoint. No verified proof-of-concept has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available for CVE-2025-30664. Refer to the Zoom Security Bulletin ZSB-25017 for vendor-provided technical details.

Detection Methods for CVE-2025-30664

Indicators of Compromise

Unexpected child processes spawned by Zoom.exe, zoom, or related helper binaries such as CptHost.exe and airhost.exe
Zoom client writing to or reading from user profile locations outside its normal working directories
Anomalous outbound network connections initiated by Zoom Workplace processes to non-Zoom infrastructure
Zoom client versions predating the fixes listed in Zoom Security Bulletin ZSB-25017

Detection Strategies

Inventory installed Zoom Workplace, Rooms, Rooms Controller, VDI, and Meeting SDK versions across managed endpoints and compare against the fixed builds in ZSB-25017.
Alert on Zoom client processes executing scripting hosts such as powershell.exe, cmd.exe, wscript.exe, or osascript as child processes.
Correlate local user session events with Zoom process activity to identify privilege boundary crossings after Zoom-hosted content is rendered.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake to enable retroactive hunting once new indicators emerge.
Track patch compliance for Zoom clients on developer, executive, and conference room endpoints, which are common exploitation targets.
Monitor Zoom Rooms and Rooms Controller devices, which are often unmanaged and slow to update.

How to Mitigate CVE-2025-30664

Immediate Actions Required

Update all Zoom Workplace, Zoom Workplace Desktop, Zoom Rooms, Zoom Rooms Controller, Zoom Meeting SDK, and Zoom Workplace VDI installations to the versions listed as fixed in ZSB-25017.
Prioritize patching of shared-use devices such as Zoom Rooms hardware, kiosks, and VDI images where multiple users share a session context.
Enforce least-privilege on endpoints so that a compromised Zoom client session cannot easily pivot to administrative operations.

Patch Information

Zoom published fixed versions in Zoom Security Bulletin ZSB-25017. Administrators should consult the bulletin for the specific minimum patched version of each affected product line and platform, then deploy through their standard software distribution mechanism.

Workarounds

No vendor-published workaround exists; updating to the patched client is the supported remediation path.
Restrict local interactive access on shared and high-value endpoints until patches are deployed.
Disable or remove the Zoom Meeting SDK integration in applications that do not require it until updated SDK builds are integrated.

bash

# Verify installed Zoom client version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ZoomUMX" /v DisplayVersion

# Verify installed Zoom client version on macOS
defaults read /Applications/zoom.us.app/Contents/Info.plist CFBundleShortVersionString

# Verify installed Zoom client version on Linux (Debian/Ubuntu)
dpkg -l | grep -i zoom