High-Severity Zoom Rooms Flaw Risks Privilege Escalation via Downgrade Protection Bypass

Zoom Video Communications has issued a critical security update for Zoom Rooms, addressing vulnerabilities in Windows and macOS clients that could allow privilege escalation or information disclosure on conference room systems, with administrators urged to apply the fixes immediately.

The most serious issue, tracked as CVE-2025-67460 for Zoom Rooms for Windows, is a high-severity flaw (CVSS 7.8) involving a failure in the downgrade protection mechanisms that could let an unauthenticated user escalate privileges via local access, according to the advisory. A separate vulnerability in Zoom Rooms for macOS, CVE-2025-67461, carries a lower CVSS of 5 and is described as an External Control of File Name or Path, potentially enabling an authenticated user to disclose information via local access.

Both flaws affect versions prior to 6.6.0, and Zoom has released fixes in version 6.6.0 for both Windows and macOS platforms, with administrators advised to update immediately to mitigate the risk.