November 15, 2026

CVE Watchtower

CVE-2025-49457Zoom Meeting Software Development Kit Untrusted Search Path

NVDCVSS scored by security@zoom.us

Vulnerability Summary

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access
Severity Level
CRITICAL(9.6)
Published Date
Aug 12, 2025
Last Modified
Sep 8, 2025
Exploitation Status
No confirmed exploitation yet
Root Weakness (CWE)
CWE-426: Untrusted Search Path β†—
The product searches for critical resources using an externally-supplied search path that can point to resources outside its direct control.
CVSS v3.1 Base Metrics — Score 9.6 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • Zoom Meeting Software Development Kit < 6.3.10
  • Zoom Rooms < 6.3.10
  • Zoom Rooms Controller < 6.3.10
  • Zoom Workplace Desktop < 6.3.10
  • Zoom Workplace Virtual Desktop Infrastructure < 6.1.16
  • Zoom Workplace Virtual Desktop Infrastructure >= 6.2.10 and < 6.2.12
Patched Versions
  • Zoom Meeting Software Development Kit 6.3.10
  • Zoom Rooms 6.3.10
  • Zoom Rooms Controller 6.3.10
  • Zoom Workplace Desktop 6.3.10
  • Zoom Workplace Virtual Desktop Infrastructure 6.1.16
  • Zoom Workplace Virtual Desktop Infrastructure 6.2.12

What to do

Plan remediation soon. No exploitation is confirmed yet, but the severity is critical.

  1. Check whether you run Zoom Meeting Software Development Kit and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Aug 12, 2025Published
  • Sep 8, 2025Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new Zoom Meeting Software Development Kit CVEsYou are reading CVE-2025-49457. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

Related Coverage

External References

Data last checked: Nov 15, 2026 09:29 UTC