CVE-2025-49457

—

CVSS 3.1

8.8 high

EPSS

<1%p47

Published

Aug 12, 2025 (Aug 12, 2025)

Modified

Jun 17, 2026

Description

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

Vendors: zoom
Products: meeting software development kit, rooms, rooms controller, workplace desktop, workplace virtual desktop infrastructure
Weakness: CWE-426
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news4 stories

Zoom fixed critical Node Multimedia Routers flaw

Security AffairsJan 21, 18:34 UTC · Jan 21, 2026Vulnerability CVE-2026-22844 CVE-2025-49457

60

⚡ Weekly Recap: NFC Fraud, Curly COMrades, N

The Hacker NewsNov 20, 10:46 UTC · Nov 20, 2025Phishing & fraud in the wildCVE-2025-8875 CVE-2025-8876 CVE-2025-26633+36 CVEs

60

Zoom and Xerox Release Critical Security Updates Fixing Privilege Escalation and RCE Flaws

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2025Vulnerability CVE-2025-49457 CVE-2025-8355 CVE-2025-8356

60

Zoom patches critical Windows flaw allowing privilege escalation

Security AffairsAug 14, 08:22 UTC · Aug 14, 2025Vulnerability CVE-2025-49457 CVE-2024-45421 CVE-2024-45419

60