Zoom Workplace for Windows Flaw Allows Local Privilege Escalation

A security flaw has been found in Zoom Workplace’s VDI Client for Windows that could enable local privilege escalation. The vulnerability, tracked as CVE-2025-64740 and issued bulletin ZSB-25042, is rated High with a CVSS score of 7.5 and requires local access to the target machine. It stems from improper verification of cryptographic signatures in the installer, meaning installation files may not be verified as legitimate before they run.

A successful exploit would allow an attacker who already has local access to elevate from a standard user to administrator-level privileges, potentially compromising sensitive data or the wider IT environment in enterprise settings. The flaw affects versions prior to 6.3.14, 6.4.12 and 6.5.10, with patches released by Zoom to address the issue.

Security researchers from Mandiant discovered and reported the vulnerability, and organisations are urged to update to the latest patched versions via the official Zoom download centre to mitigate the risk.