CVE-2025-64740 Overview
CVE-2025-64740 affects the Zoom Workplace Virtual Desktop Infrastructure (VDI) Client installer for Windows. The installer fails to properly verify cryptographic signatures, allowing an authenticated local user to escalate privileges. Zoom disclosed the flaw in security bulletin ZSB-25042 and assigned it a CVSS 3.1 base score of 7.8. The weakness is classified under [CWE-347] Improper Verification of Cryptographic Signature. Exploitation requires local access and low privileges, but yields high impact on confidentiality, integrity, and availability. No public exploit code or in-the-wild abuse has been reported at the time of publication.
Critical Impact
A local authenticated attacker can leverage the installer's signature verification weakness to execute code with elevated privileges on affected Windows endpoints.
Affected Products
- Zoom Workplace VDI Client for Windows (versions prior to the fix noted in ZSB-25042)
- Windows endpoints running the Zoom Workplace VDI installer
- VDI environments deploying Zoom Workplace client packages
Discovery Timeline
- 2025-11-13 - CVE-2025-64740 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64740
Vulnerability Analysis
The vulnerability resides in the installer component of the Zoom Workplace VDI Client for Windows. Installers commonly execute with elevated privileges to place binaries in protected directories and register system services. When an installer fails to fully validate the cryptographic signature of files or components it processes, an attacker can substitute attacker-controlled content that the installer then executes or trusts. In this case, a local authenticated user can exploit the flawed verification path to run code in an elevated context. The result is a full privilege escalation on the host, letting an attacker move from a standard user account to administrative control.
Root Cause
The root cause is improper verification of cryptographic signatures within the installer workflow, mapped to [CWE-347]. The installer does not enforce a strict signature check on all components it consumes before executing or loading them. This allows unsigned or improperly signed content to be treated as trusted.
Attack Vector
Exploitation requires local access and an authenticated session on the target Windows system. The attacker stages malicious content that the installer processes without adequate signature validation. When the installer runs, either as part of an upgrade, repair, or scheduled action, it executes attacker-controlled logic with elevated privileges. User interaction is not required beyond the normal installer invocation. Refer to the Zoom Security Bulletin ZSB-25042 for vendor-published technical details.
Detection Methods for CVE-2025-64740
Indicators of Compromise
- Unexpected file modifications or new binaries within the Zoom VDI installation directory prior to installer execution.
- Installer processes spawning child processes that write to or execute from user-writable paths.
- New local administrator accounts or scheduled tasks created shortly after a Zoom VDI installer run.
Detection Strategies
- Monitor process ancestry for Zoom installer executables launching non-Zoom binaries or scripts.
- Alert on file writes into Zoom VDI installer working directories by non-privileged users.
- Correlate installer execution events with privilege changes on the same host within a short time window.
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) and command-line logging on endpoints running Zoom VDI.
- Track integrity of the Zoom VDI installer package and staging directories using file integrity monitoring.
- Review endpoint telemetry for privilege escalation patterns following software installation activity.
How to Mitigate CVE-2025-64740
Immediate Actions Required
- Update the Zoom Workplace VDI Client for Windows to the fixed version listed in Zoom Security Bulletin ZSB-25042.
- Restrict local user permissions on VDI endpoints to limit who can trigger or stage installer content.
- Audit endpoints for prior installer executions and validate the integrity of installed Zoom binaries.
Patch Information
Zoom has released a fixed version of the Zoom Workplace VDI Client for Windows as documented in Zoom Security Bulletin ZSB-25042. Administrators should upgrade all affected endpoints to the patched release. Verify version compliance across the VDI fleet using existing software inventory tooling.
Workarounds
- Block non-administrative users from executing the Zoom VDI installer through application control policies such as Windows Defender Application Control or AppLocker.
- Restrict write access to installer staging paths to trusted administrators only.
- Distribute the installer exclusively through managed software deployment tools to prevent user-initiated runs.
# Example AppLocker rule concept: restrict installer execution to administrators
# Configure via Group Policy > Windows Settings > Security Settings > Application Control Policies > AppLocker
# Rule type: Executable Rules
# Action: Deny
# User/Group: Everyone (except BUILTIN\Administrators)
# Path: %ProgramFiles%\Zoom\VDI\*Installer*.exe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
