CVE-2025-49457: Zoom SDK Privilege Escalation Flaw

CVE-2025-49457 Overview

CVE-2025-49457 is a privilege escalation vulnerability affecting multiple Zoom Clients for Windows. The vulnerability stems from an untrusted search path issue (CWE-426) that allows an unauthenticated attacker to escalate privileges via network access. This flaw affects several Zoom products, including the Workplace Desktop client, Rooms, Rooms Controller, Virtual Desktop Infrastructure, and the Meeting Software Development Kit.

Critical Impact

An unauthenticated attacker can exploit this untrusted search path vulnerability to achieve privilege escalation over the network, potentially gaining elevated access to Windows systems running vulnerable Zoom clients.

Affected Products

• Zoom Workplace Desktop for Windows
• Zoom Rooms for Windows
• Zoom Rooms Controller for Windows
• Zoom Workplace Virtual Desktop Infrastructure for Windows
• Zoom Meeting Software Development Kit for Windows

Discovery Timeline

• 2025-08-12 - CVE-2025-49457 published to NVD
• 2025-09-08 - Last updated in NVD database

Technical Details for CVE-2025-49457

Vulnerability Analysis

This vulnerability is classified as an Untrusted Search Path issue (CWE-426), which occurs when an application searches for resources such as DLLs or executables in directories that may be controlled by untrusted users. In the context of Zoom Clients for Windows, the application may load libraries or components from locations in the search path that an attacker can manipulate.

The attack requires user interaction, meaning the victim must perform some action (such as opening a malicious file or clicking a link) for the exploitation to succeed. Once triggered, the vulnerability allows complete compromise of the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause is an insecure DLL search order or path handling mechanism within the affected Zoom Windows clients. When the application attempts to load dynamic libraries, it does not properly validate the source directory, allowing attackers to place malicious DLLs in locations that will be searched before legitimate system directories. This type of vulnerability is commonly known as DLL hijacking or DLL preloading.

Attack Vector

The attack is network-based and does not require prior authentication to the target system. An attacker can exploit this vulnerability by:

1. Positioning a malicious DLL in a network-accessible location or in a directory within the victim's search path
2. Enticing the victim to perform an action that triggers the vulnerable Zoom client to load the malicious library
3. Gaining execution in the context of the Zoom application, potentially with elevated privileges

The vulnerability mechanism involves the Windows DLL search order, where applications may search the current working directory or other attacker-controllable locations before system directories. When a user opens certain file types or accesses content from network shares, the Zoom client may inadvertently load malicious code placed by the attacker.

Detection Methods for CVE-2025-49457

Indicators of Compromise

• Unusual DLL files appearing in network shares accessed by Zoom clients
• Unexpected DLL load events from non-standard directories in Zoom process context
• Suspicious network activity associated with Zoom client processes attempting to load remote resources

Detection Strategies

• Monitor for DLL load events from Zoom processes (Zoom.exe, ZoomRooms.exe) that originate from user-writable or network-accessible directories
• Implement application whitelisting to prevent unauthorized DLL loading in Zoom installation directories
• Use Windows Defender Attack Surface Reduction (ASR) rules to block DLL loading from untrusted locations

Monitoring Recommendations

• Enable Sysmon or Windows Event logging for image load events (Event ID 7) to track DLL loading behavior
• Configure EDR solutions to alert on Zoom processes loading DLLs from atypical paths such as %TEMP%, network shares, or user profile directories
• Audit file creation events in directories commonly used for DLL hijacking attacks

How to Mitigate CVE-2025-49457

Immediate Actions Required

• Update all affected Zoom products to the latest patched versions as specified in the vendor security bulletin
• Restrict access to network shares and ensure proper permissions on directories accessible to Zoom clients
• Review and harden DLL search order settings using Windows Group Policy where applicable
• Consider blocking execution of unsigned DLLs from network locations

Patch Information

Zoom has released security updates to address this vulnerability. Organizations should consult the Zoom Security Bulletin ZSB-25030 for specific version information and download links for patched releases. It is critical to update all affected products including Zoom Workplace Desktop, Rooms, Rooms Controller, Virtual Desktop Infrastructure, and the Meeting SDK for Windows.

Workarounds

• Implement application control policies to prevent DLL loading from untrusted directories until patches can be applied
• Use network segmentation to limit exposure of vulnerable Zoom clients to potentially malicious network resources
• Configure Windows Safe DLL Search Mode via registry to prioritize system directories in the DLL search path

# Enable Safe DLL Search Mode via Registry
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v SafeDllSearchMode /t REG_DWORD /d 1 /f