CVE-2025-58134: Zoom Meeting SDK Auth Bypass Vulnerability

CVE-2025-58134 Overview

CVE-2025-58134 is an incorrect authorization vulnerability [CWE-863] affecting multiple Zoom Workplace Clients for Windows. The flaw allows an authenticated user to conduct an integrity impact against the client through network access. The issue is tracked under Zoom Security Bulletin ZSB-25035.

Exploitation requires user interaction and network access to the target client. The vulnerability does not expose confidential information or affect availability, limiting the scope to integrity modifications performed under the abused authorization path.

Critical Impact
An attacker with network access can bypass authorization checks in the Windows Zoom client to modify data or state that should be restricted, provided the target user interacts with the attacker-controlled input.

Affected Products

Zoom Meeting Software Development Kit for Windows
Zoom Rooms and Zoom Rooms Controller for Windows
Zoom Workplace Desktop for Windows
Zoom Workplace Virtual Desktop Infrastructure (VDI) for Windows

Discovery Timeline

2025-09-09 - CVE-2025-58134 published to the National Vulnerability Database
2025-09-09 - Zoom publishes Security Bulletin ZSB-25035
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58134

Vulnerability Analysis

The vulnerability stems from an incorrect authorization check [CWE-863] in specific Zoom Workplace Client builds for Windows. Authorization logic fails to correctly validate whether an authenticated actor is permitted to perform certain operations that alter client state or data.

Because the flaw is exposed over the network and requires user interaction, an attacker positions crafted input that reaches the vulnerable authorization path once the user takes an action such as joining or interacting with a session. The confidentiality impact is none and availability is not affected, but integrity can be modified within the scope of the client.

The issue spans multiple Windows client families sharing the same authorization component, including the Meeting SDK, Rooms, Rooms Controller, Workplace Desktop, and Workplace VDI clients. Consult Zoom Security Bulletin ZSB-25035 for exact fixed versions.

Root Cause

The root cause is an authorization decision that trusts client-supplied context or fails to enforce the full policy required for a privileged operation. The check either omits a required attribute or evaluates it incorrectly, producing an allow decision where a deny should occur.

Attack Vector

The attack vector is network-based. An attacker delivers crafted content or a crafted interaction to a targeted user of the Windows client. When the user interacts with the content, the vulnerable code path executes with the user's authenticated context and performs an unauthorized state change.

No public proof-of-concept is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS is 0.19%. Technical exploitation details are not disclosed in the Zoom advisory.

Detection Methods for CVE-2025-58134

Indicators of Compromise

Zoom Workplace Client versions on Windows below the fixed builds listed in ZSB-25035
Unexpected configuration or state changes in Zoom client profiles following meeting interactions
Anomalous outbound connections from Zoom.exe or associated helper processes to non-Zoom infrastructure

Detection Strategies

Inventory endpoints running Zoom Workplace Desktop, Rooms, Rooms Controller, Meeting SDK, and VDI clients and compare installed versions against Zoom's fixed release list
Monitor for local file, registry, or configuration modifications made by Zoom client processes shortly after meeting join events
Correlate Windows process telemetry from Zoom.exe, CptHost.exe, and CptControl.exe with unusual child processes or module loads

Monitoring Recommendations

Enable endpoint detection and response telemetry on all Windows hosts running Zoom clients and preserve process, file, and network events
Alert on Zoom client versions that fall behind current Zoom security bulletin releases
Track network connections from Zoom processes to domains outside the official Zoom service ranges

How to Mitigate CVE-2025-58134

Immediate Actions Required

Update all Windows Zoom Workplace Desktop, Rooms, Rooms Controller, Meeting SDK, and VDI clients to the fixed versions listed in ZSB-25035
Enforce automatic updates for the Zoom client across the fleet through group policy or endpoint management tooling
Audit developer and integrator systems that embed the Zoom Meeting SDK and rebuild against the patched SDK version

Patch Information

Zoom has released patched versions addressing CVE-2025-58134 across all affected Windows clients. Refer to Zoom Security Bulletin ZSB-25035 for the specific fixed build numbers per product line. No CISA KEV listing exists and no public exploit code is currently available.

Workarounds

No vendor-supplied workaround is documented; patching is the required remediation path
Restrict acceptance of external meeting invitations and shared content from untrusted sources until clients are upgraded
Where immediate updates are not feasible, limit use of Zoom Rooms Controller and Meeting SDK integrations to trusted internal networks

bash

# Query installed Zoom client version on Windows endpoints
Get-ItemProperty "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Zoom*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation