CVE-2025-49459: Zoom Workplace Privilege Escalation Flaw

CVE-2025-49459 Overview

CVE-2025-49459 is a missing authorization vulnerability [CWE-862] in the Zoom Workplace for Windows on ARM installer. Versions before 6.5.0 do not properly enforce authorization checks during installation routines. An authenticated local user can abuse the flaw to escalate privileges on the affected host.

The issue is tracked in Zoom Security Bulletin ZSB-25032 and affects the Windows ARM build of Zoom Workplace. Exploitation requires local access and low-privileged authentication, but no user interaction. Successful exploitation yields high impact to confidentiality, integrity, and availability.

Critical Impact
An authenticated local user can escalate privileges on Windows ARM systems running Zoom Workplace prior to 6.5.0, gaining higher-privileged code execution through the installer component.

Affected Products

Zoom Workplace for Windows on ARM prior to version 6.5.0
Zoom installer component on Windows ARM builds
Endpoints running vulnerable Zoom Workplace desktop client for ARM64 Windows

Discovery Timeline

2025-09-09 - CVE-2025-49459 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49459

Vulnerability Analysis

The vulnerability originates in the installer for Zoom Workplace on Windows ARM. The installer performs privileged actions but omits authorization checks that would restrict those actions to appropriate security contexts. An authenticated local user can invoke or influence installer functionality that runs at a higher privilege level than the caller.

Missing authorization flaws in installer components are a recurring vector for local privilege escalation on Windows. Installers typically run with SYSTEM or administrative rights to place files, modify services, or update registry keys. When those operations lack caller validation, standard users can direct privileged behavior to achieve escalation.

Because exploitation requires only low privileges and no user interaction, any interactive or service-account user on an affected host presents a viable exploitation surface. The confidentiality, integrity, and availability impact is high, aligning with full local privilege takeover on the endpoint.

Root Cause

The root cause is an authorization gap [CWE-862] in the Zoom Workplace Windows ARM installer. Privileged operations in the installer do not verify that the invoking user is authorized to trigger them, allowing a lower-privileged authenticated user to execute paths reserved for administrators or the local SYSTEM account.

Attack Vector

The attack vector is local. An authenticated user with existing access to a Windows ARM host running a vulnerable Zoom Workplace build interacts with the installer through its exposed interfaces. Refer to the Zoom Security Bulletin ZSB-25032 for vendor technical details. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2025-49459

Indicators of Compromise

Unexpected execution of Zoom installer binaries (ZoomInstaller.exe, ZoomInstallerFull.exe) by non-administrative users on Windows ARM hosts.
New services, scheduled tasks, or files written to privileged paths such as C:\Program Files\Zoom\ immediately following installer invocation by standard users.
Zoom Workplace client versions earlier than 6.5.0 present on Windows ARM endpoints.

Detection Strategies

Inventory installed Zoom Workplace versions on ARM64 Windows devices and flag any build below 6.5.0.
Alert on process-creation events where Zoom installer executables are launched by user contexts other than administrators or SYSTEM.
Correlate installer activity with subsequent privilege changes, token elevation, or service creation events on the same host.

Monitoring Recommendations

Enable Windows process auditing and command-line logging to capture installer invocation and parent-child process relationships.
Monitor Sysmon Event IDs 1 (process creation) and 11 (file create) for Zoom installer artifacts written outside standard update workflows.
Track integrity-level transitions from Medium to High or System around Zoom installer execution.

How to Mitigate CVE-2025-49459

Immediate Actions Required

Upgrade Zoom Workplace for Windows on ARM to version 6.5.0 or later on all affected endpoints.
Restrict local logon rights on Windows ARM devices to trusted users to reduce the pool of potential local attackers.
Audit endpoints for the presence of vulnerable Zoom Workplace ARM builds and prioritize remediation for shared or multi-user systems.

Patch Information

Zoom released a fixed build in Zoom Workplace for Windows on ARM version 6.5.0. See the Zoom Security Bulletin ZSB-25032 for the vendor advisory and download guidance.

Workarounds

Block execution of outdated Zoom installer binaries through application control policies until the upgrade is deployed.
Enforce least-privilege on Windows ARM endpoints so unauthorized users cannot invoke installer entry points.
Use managed software deployment to push the 6.5.0 update instead of relying on end-user-initiated installers.

bash

# Example: query installed Zoom Workplace version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Zoom*" } |
  Select-Object DisplayName, DisplayVersion, Publisher