High · published November 13, 2025
⚡ An improper verification of cryptographic signatures in Zoom's Workplace VDI Client could let an authenticated user escalate privileges with local access! Think of it like a hotel giving a guest a master key that works for every room without checking who they are—suddenly, they have access to places they shouldn't. That's the reality here; someone with local access could exploit this oversight! This vulnerability could allow a malicious user to gain unauthorized control over the system, potentially leading to data leaks, unauthorized changes, or installation of malicious software. It's like giving a troublemaker a VIP pass to access all the secure areas!
Think of it like a hotel giving a guest a master key that works for every room without checking who they are—suddenly, they have access to places they shouldn't. That's the reality here; someone with local access could exploit this oversight! CVE-2025-64740 stems from improper verification of cryptographic signatures in the installer for the Zoom Workplace VDI Client for Windows. This flaw allows an authenticated user to escalate their privileges if they can manipulate the installation process.
This vulnerability could allow a malicious user to gain unauthorized control over the system, potentially leading to data leaks, unauthorized changes, or installation of malicious software. It's like giving a troublemaker a VIP pass to access all the secure areas! To mitigate this risk, ensure that you patch the Zoom Workplace VDI Client to the latest version as soon as it becomes available. Regularly audit your system access protocols and ensure all users have the appropriate permissions. Stay vigilant! You've got this! With a few updates and checks, you can secure your Zoom environment and keep those pesky privilege escalations at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zoom/workplace_virtual_desktop_infrastructure | < 6.3.14 | 6.3.14 |
| zoom/workplace_virtual_desktop_infrastructure | ≥ 6.4.10, < 6.4.12 | 6.4.12 |