CVE-2025-58132: Zoom Meeting SDK RCE Vulnerability

CVE-2025-58132 Overview

CVE-2025-58132 is a command injection vulnerability affecting multiple Zoom Clients for Windows. An authenticated user with network access can exploit the flaw to disclose sensitive information from affected systems. Zoom addressed the issue in security bulletin ZSB-25038. The vulnerability is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact

An authenticated remote attacker can inject commands into vulnerable Zoom Windows clients to disclose confidential information without requiring user interaction.

Affected Products

• Zoom Meeting Software Development Kit (SDK) for Windows
• Zoom Rooms for Windows
• Zoom Workplace Desktop for Windows
• Zoom Workplace Virtual Desktop Infrastructure (VDI) for Windows

Discovery Timeline

• 2025-10-15 - CVE-2025-58132 published to the National Vulnerability Database (NVD)
• 2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-58132

Vulnerability Analysis

The flaw resides in the command-handling logic of multiple Zoom Windows clients. Attacker-controlled input reaches a command execution context without proper neutralization of special elements. An authenticated user with low privileges can send crafted input over the network to trigger command injection. Successful exploitation discloses sensitive information from the affected client, though it does not directly affect integrity or availability.

The EPSS probability for CVE-2025-58132 is approximately 1.82%, placing it in the 78th percentile for likelihood of exploitation activity. No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is improper neutralization of special elements used in a command, classified as [CWE-77]. Zoom's Windows client code paths that construct and dispatch commands fail to sanitize untrusted input supplied by an authenticated session. When attacker-controlled strings are concatenated into a command, injected directives execute in the context of the application.

Attack Vector

Exploitation requires network reachability and valid authentication to the targeted Zoom service or session context. No user interaction is required on the victim side. The attacker crafts a message or payload containing command-injection sequences and delivers it through supported client interfaces. The vulnerable client parses the input and executes attacker-specified commands, returning data that enables information disclosure.

See the Zoom Security Bulletin ZSB-25038 for vendor technical details.

Detection Methods for CVE-2025-58132

Indicators of Compromise

• Unexpected child processes spawned by Zoom client executables such as Zoom.exe, Zoomroom.exe, or associated SDK host processes.
• Outbound network connections from Zoom client processes to non-Zoom infrastructure immediately following inbound session activity.
• Anomalous file reads or registry queries performed by Zoom processes outside their normal operational baseline.

Detection Strategies

• Hunt for Zoom client processes invoking command interpreters such as cmd.exe, powershell.exe, or wscript.exe with suspicious arguments.
• Correlate Zoom client version telemetry against the fixed versions listed in Zoom bulletin ZSB-25038 to identify unpatched endpoints.
• Review authentication logs for Zoom sessions originating from unexpected geolocations or accounts that subsequently exhibit anomalous client behavior.

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) tooling to capture process lineage and command-line arguments for Zoom client executables.
• Enable Windows process creation auditing (Event ID 4688) with command-line logging across endpoints running Zoom.
• Forward Zoom client logs and endpoint telemetry to a centralized SIEM for behavioral baselining and alerting on deviations.

How to Mitigate CVE-2025-58132

Immediate Actions Required

• Inventory all Windows endpoints and virtual desktops running Zoom Workplace Desktop, Zoom Rooms, Zoom VDI, or applications built on the Zoom Meeting SDK.
• Apply the fixed Zoom client versions published in ZSB-25038 as soon as the update is validated in your environment.
• Restrict Zoom meeting access using authentication requirements, waiting rooms, and passcodes to limit exposure to untrusted authenticated participants.
• Audit recent Zoom client activity for the behavioral indicators listed above and investigate anomalies.

Patch Information

Zoom has released fixed versions of the affected Windows clients. Refer to Zoom security bulletin ZSB-25038 for the complete list of patched versions covering the Meeting SDK, Rooms, Workplace Desktop, and Workplace VDI clients. Install the updated clients through automatic updates, enterprise deployment tooling, or direct download from the Zoom download center.

Workarounds

• No vendor-supplied workaround is listed in ZSB-25038; patching is the recommended remediation path.
• Limit Zoom meeting participation to authenticated users within trusted tenants until patches are deployed.
• Enforce application allowlisting policies that restrict Zoom client processes from spawning command interpreters or unexpected child processes.

# Verify installed Zoom client version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Zoom*" } |
  Select-Object DisplayName, DisplayVersion, Publisher