CVE-2025-49457: Zoom SDK Privilege Escalation Flaw

CVE-2025-49457 Overview

CVE-2025-49457 is a privilege escalation vulnerability affecting multiple Zoom Clients for Windows. The vulnerability stems from an untrusted search path issue (CWE-426) that allows an unauthenticated attacker to escalate privileges via network access. This flaw affects several Zoom products, including the Workplace Desktop client, Rooms, Rooms Controller, Virtual Desktop Infrastructure, and the Meeting Software Development Kit.

Critical Impact
An unauthenticated attacker can exploit this untrusted search path vulnerability to achieve privilege escalation over the network, potentially gaining elevated access to Windows systems running vulnerable Zoom clients.

Affected Products

Zoom Workplace Desktop for Windows
Zoom Rooms for Windows
Zoom Rooms Controller for Windows
Zoom Workplace Virtual Desktop Infrastructure for Windows
Zoom Meeting Software Development Kit for Windows

Discovery Timeline

2025-08-12 - CVE-2025-49457 published to NVD
2025-09-08 - Last updated in NVD database

Technical Details for CVE-2025-49457

Vulnerability Analysis

This vulnerability is classified as an Untrusted Search Path issue (CWE-426), which occurs when an application searches for resources such as DLLs or executables in directories that may be controlled by untrusted users. In the context of Zoom Clients for Windows, the application may load libraries or components from locations in the search path that an attacker can manipulate.

The attack requires user interaction, meaning the victim must perform some action (such as opening a malicious file or clicking a link) for the exploitation to succeed. Once triggered, the vulnerability allows complete compromise of the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is an insecure DLL search order or path handling mechanism within the affected Zoom Windows clients. When the application attempts to load dynamic libraries, it does not properly validate the source directory, allowing attackers to place malicious DLLs in locations that will be searched before legitimate system directories. This type of vulnerability is commonly known as DLL hijacking or DLL preloading.

Attack Vector

The attack is network-based and does not require prior authentication to the target system. An attacker can exploit this vulnerability by:

Positioning a malicious DLL in a network-accessible location or in a directory within the victim's search path
Enticing the victim to perform an action that triggers the vulnerable Zoom client to load the malicious library
Gaining execution in the context of the Zoom application, potentially with elevated privileges

The vulnerability mechanism involves the Windows DLL search order, where applications may search the current working directory or other attacker-controllable locations before system directories. When a user opens certain file types or accesses content from network shares, the Zoom client may inadvertently load malicious code placed by the attacker.

Detection Methods for CVE-2025-49457

Indicators of Compromise

Unusual DLL files appearing in network shares accessed by Zoom clients
Unexpected DLL load events from non-standard directories in Zoom process context
Suspicious network activity associated with Zoom client processes attempting to load remote resources

Detection Strategies

Monitor for DLL load events from Zoom processes (Zoom.exe, ZoomRooms.exe) that originate from user-writable or network-accessible directories
Implement application whitelisting to prevent unauthorized DLL loading in Zoom installation directories
Use Windows Defender Attack Surface Reduction (ASR) rules to block DLL loading from untrusted locations

Monitoring Recommendations

Enable Sysmon or Windows Event logging for image load events (Event ID 7) to track DLL loading behavior
Configure EDR solutions to alert on Zoom processes loading DLLs from atypical paths such as %TEMP%, network shares, or user profile directories
Audit file creation events in directories commonly used for DLL hijacking attacks

How to Mitigate CVE-2025-49457

Immediate Actions Required

Update all affected Zoom products to the latest patched versions as specified in the vendor security bulletin
Restrict access to network shares and ensure proper permissions on directories accessible to Zoom clients
Review and harden DLL search order settings using Windows Group Policy where applicable
Consider blocking execution of unsigned DLLs from network locations

Patch Information

Zoom has released security updates to address this vulnerability. Organizations should consult the Zoom Security Bulletin ZSB-25030 for specific version information and download links for patched releases. It is critical to update all affected products including Zoom Workplace Desktop, Rooms, Rooms Controller, Virtual Desktop Infrastructure, and the Meeting SDK for Windows.

Workarounds

Implement application control policies to prevent DLL loading from untrusted directories until patches can be applied
Use network segmentation to limit exposure of vulnerable Zoom clients to potentially malicious network resources
Configure Windows Safe DLL Search Mode via registry to prioritize system directories in the DLL search path

bash

# Enable Safe DLL Search Mode via Registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f