November 15, 2026

CVE Watchtower

CVE-2025-49456Zoom Meeting Software Development Kit Untrusted Search Path

NVDCVSS scored by security@zoom.us

Vulnerability Summary

Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.
Severity Level
MEDIUM(6.2)
Published Date
Aug 12, 2025
Last Modified
Sep 8, 2025
Exploitation Status
No confirmed exploitation yet
Root Weakness (CWE)
CWE-426: Untrusted Search Path β†—
The product searches for critical resources using an externally-supplied search path that can point to resources outside its direct control.
CWE-362: Race Condition β†—
The product contains a concurrent code sequence that requires exclusive access to a shared resource, but a timing window exists in which another code sequence can modify the resource.
CVSS v3.1 Base Metrics — Score 6.2 (MEDIUM)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityNone

Affected & Patched Versions

Affected Versions
  • Zoom Meeting Software Development Kit < 6.4.10
  • Zoom Rooms < 6.4.5
  • Zoom Rooms Controller < 6.4.5
  • Zoom Workplace Desktop < 6.4.10
  • Zoom Workplace Virtual Desktop Infrastructure < 6.2.15
  • Zoom Workplace Virtual Desktop Infrastructure >= 6.3.10 and < 6.3.12
Patched Versions
  • Zoom Meeting Software Development Kit 6.4.10
  • Zoom Rooms 6.4.5
  • Zoom Rooms Controller 6.4.5
  • Zoom Workplace Desktop 6.4.10
  • Zoom Workplace Virtual Desktop Infrastructure 6.2.15
  • Zoom Workplace Virtual Desktop Infrastructure 6.3.12

What to do

Fix it during your normal patch cycle. No exploitation is confirmed yet.

  1. Check whether you run Zoom Meeting Software Development Kit and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Aug 12, 2025Published
  • Sep 8, 2025Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Zoom Meeting Software Development Kit CVEsYou are reading CVE-2025-49456. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

External References

Data last checked: Nov 15, 2026 09:29 UTC