What’s Vulnerable › Vulnerabilities
CVE-2025-0145: Zoom Workplace Apps for Windows - Untrusted Search Path
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-01-30 · updated 2026-06-17
- Weakness: CWE-426
Description
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
Affected products
- Zoom Meeting Software Development Kit: before 6.2.5 — fixed in 6.2.5
- Zoom Video Communications, Inc. Zoom Rooms for Windows: before 6.2.5 — fixed in 6.2.5
- Zoom Rooms Controller: before 6.2.5 — fixed in 6.2.5
- Zoom Video Software Development Kit: before 6.2.5 — fixed in 6.2.5
- Zoom Communications, Inc Zoom Workplace Desktop App for macOS: before 6.2.5 — fixed in 6.2.5
- Zoom Communications Zoom Workplace VDI Plugin: before 6.0.15; from 6.0.16 before 6.1.13 — fixed in 6.0.15, 6.1.13
How to fix
Upgrade to a fixed version: Zoom Meeting Software Development Kit 6.2.5; Zoom Video Communications, Inc. Zoom Rooms for Windows 6.2.5; Zoom Rooms Controller 6.2.5; Zoom Video Software Development Kit 6.2.5; Zoom Communications, Inc Zoom Workplace Desktop App for macOS 6.2.5; Zoom Communications Zoom Workplace VDI Plugin 6.0.15, 6.1.13. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-0145 or the next vulnerability affects your stack