InfoSecBulletin Cybersecurity for mankind
Zoom has released security updates for its Windows clients to fix two major vulnerabilities, CVE-2025-49456 and CVE-2025-49457, which could allow attackers to exploit race conditions and untrusted search paths.
The first flaw, CVE-2025-49456 (CVSS 6.2), is a race condition in the installer for certain Zoom Clients for Windows. According to Zoom, it “may allow an unauthenticated user to impact application integrity via local access.”
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
This means that a local attacker could potentially manipulate the installation process to alter or replace application files before they are properly secured, potentially enabling malicious code execution.
The second and more severe issue, CVE-2025-49457 (CVSS 9.6), is an untrusted search path vulnerability in certain Zoom Clients for Windows. Zoom warns that it “may allow an unauthenticated user to conduct an escalation of privilege via network access.”
By placing a malicious file in a location searched before the legitimate file path, an attacker—potentially over a network share—could trick the application into executing malicious code with elevated privileges.
Both vulnerabilities have been fixed in the latest releases. Zoom advises all users to immediately update their clients to the patched versions via the official Zoom Download Center.
