CVE-2025-49457CWE-426

Zoom Clients for Windows - Untrusted Search Path

Critical · published August 12, 2025

CVSS v3.1
9.6
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

🚨 An untrusted search path in certain Zoom Clients for Windows makes it alarmingly simple for an unauthenticated user to elevate privileges—like a party crasher suddenly getting access to the VIP lounge! 🔥 Think of it like a restaurant where the staff mistakenly leaves the back door unlocked, allowing anyone passing by to walk right into the kitchen and mess with the orders. This flaw lets attackers sneak in and gain far more access than they should have. If exploited, this vulnerability could allow an attacker to execute arbitrary code with elevated privileges, putting sensitive data at risk and even enabling them to take control of the system. Imagine the chaos if someone could waltz through the back door and change the menu without the chef’s knowledge—absolutely devastating!

Put simply

Think of it like a restaurant where the staff mistakenly leaves the back door unlocked, allowing anyone passing by to walk right into the kitchen and mess with the orders. This flaw lets attackers sneak in and gain far more access than they should have. This untrusted search path vulnerability allows an unauthenticated user to conduct an escalation of privilege via network access, compromising the security of the Zoom Client on Windows.

What to do

If exploited, this vulnerability could allow an attacker to execute arbitrary code with elevated privileges, putting sensitive data at risk and even enabling them to take control of the system. Imagine the chaos if someone could waltz through the back door and change the menu without the chef’s knowledge—absolutely devastating! Update your Zoom Client to the latest version immediately! Ensure any unnecessary services are disabled and consider implementing strict access controls to limit network access. Regularly audit your software for vulnerabilities to keep your environment secure. You've got this! Fixing this issue will tighten your security and help ensure a safer Zoom experience for everyone. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00624 · 49.2th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-08-12T22:54Z
EPSS history
Timeline
  • 12 AUG 22:54Z
    Zoom Clients for Windows - Untrusted Search Path
    cvelistv5