InfoSecBulletin Cybersecurity for mankind
Zoom has released security updates for its Windows clients to fix two major vulnerabilities, CVE-2025-49456 and CVE-2025-49457, which could allow attackers to exploit race conditions and untrusted search paths.
The first flaw, CVE-2025-49456 (CVSS 6.2), is a race condition in the installer for certain Zoom Clients for Windows. According to Zoom, it “may allow an unauthenticated user to impact application integrity via local access.”
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
This means that a local attacker could potentially manipulate the installation process to alter or replace application files before they are properly secured, potentially enabling malicious code execution.
The second and more severe issue, CVE-2025-49457 (CVSS 9.6), is an untrusted search path vulnerability in certain Zoom Clients for Windows. Zoom warns that it “may allow an unauthenticated user to conduct an escalation of privilege via network access.”
By placing a malicious file in a location searched before the legitimate file path, an attacker—potentially over a network share—could trick the application into executing malicious code with elevated privileges.
Both vulnerabilities have been fixed in the latest releases. Zoom advises all users to immediately update their clients to the patched versions via the official Zoom Download Center.
