Introduction
A privilege escalation attack against a video conferencing platform can give an attacker access to sensitive meetings, a way to exfiltrate data, and a foothold for lateral movement inside an enterprise network. CVE-2025-49457, recently disclosed in Zoom Clients for Windows, is a critical risk of this kind, and Zoom is a communication tool that nearly every organization uses.
Technical information
CVE-2025-49457 is an untrusted search path vulnerability in Zoom Clients for Windows. The flaw comes from improper handling of DLL search paths. When the Zoom client loads a dynamic link library without an absolute path, Windows follows its standard search order, which includes the application's directory, the system directories, and any directory listed in the PATH environment variable. If an attacker can place a malicious DLL in a location that Windows searches before it reaches the legitimate library, the Zoom client may load and execute the attacker's code with the application's privileges.
The vulnerability is classified under CWE-426 (Untrusted Search Path). An attacker does not need to authenticate and can exploit it over the network, for example by placing malicious DLLs on network shares or remote file systems that the target system can reach. The injected code runs in the context of the Zoom client, potentially with elevated permissions, so the result is privilege escalation. No public code snippets or proof of concept are available as of this writing.
Patch information
Zoom has released version 6.3.0 of its Workplace Apps and Meeting SDKs, which fixes CVE-2025-49457 along with several other high-severity vulnerabilities. Users and organizations must update all Zoom Windows clients to version 6.3.0 or later to fix this issue. The update is available through official Zoom distribution channels.
Patch details are in these bulletins:
Affected systems and versions
- Zoom Clients for Windows prior to version 6.3.0 are affected.
- Any configuration of the Windows client is vulnerable if it lets an attacker place files in directories that the DLL loader searches.
- The vulnerability is not limited to a specific edition or deployment scenario.
Vendor security history
Zoom has fixed similar vulnerabilities before, including CVE-2024-24697, another untrusted search path issue in the Windows client. The company has improved its vulnerability response process and issues timely advisories and coordinated patches. Still, DLL search path flaws keep recurring, which indicates ongoing problems with secure Windows application development in Zoom's engineering practices.
