Zoom Security Update Fixes Vulnerabilities in Windows Client and Workplace Platform

On 9 September 2025, Zoom released an urgent security update for its Windows client and Workplace platform to tackle ten security bulletins across Windows and macOS clients and Workplace.

The update fixes a critical Untrusted Search Path flaw in the Windows desktop client (CVE-2025-49457) that could allow an attacker with local access to load malicious code from an unintended directory when Zoom starts, and a High-severity issue in Zoom Workplace for Windows on ARM (CVE-2025-49459) relating to missing authorisation. The remaining fixes address medium-severity problems, including race conditions, improper authorisation, cross-site scripting and buffer overflows across Zoom’s environments.

Users are urged to apply the patch immediately to protect systems, with Windows and Workplace on Windows ARM devices highlighted as priorities. To update, users should run Check for Updates in the Windows client or administrate via the Workplace management console, while other platforms such as macOS, Linux and iOS should be updated through their app stores or package managers. There is no indication that these vulnerabilities have been exploited in active attacks, but delaying the update could increase exposure.