CVE-2025-0145

What it is

Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2025-01-30 20:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 08:25 UTC Last updatedMost recent change to the record

Details

Published

2025-01-30 20:15 UTC

Last modified

2026-06-17 08:25 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-426

Record status

Analyzed

Affected

• Zoom Meeting Software Development Kit < 6.2.5
• Zoom Rooms < 6.2.5
• Zoom Rooms Controller < 6.2.5
• Zoom Video Software Development Kit < 6.2.5
• Zoom Workplace Desktop < 6.2.5
• Zoom Workplace Virtual Desktop Infrastructure < 6.0.15
• Zoom Workplace Virtual Desktop Infrastructure < 6.1.13

Attack profile CVSS 3.1 · 4.6

Attack vector

Local

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

Low