CVE-2025-49456

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-426 CWE-362

Affected software

Vendor	Product	Versions
Zoom Communications Inc	Zoom Clients for Windows	see references

References

https://www.zoom.com/en/trust/security-bulletin/zsb-25029Vendor Advisory

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-494578.8Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via networ CVE-2025-494586.5Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access.CVE-2025-494597.8Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conduct CVE-2025-49468.1The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_ac CVE-2025-494607.5Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via net CVE-2025-494617.4Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-494623.5Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information vi CVE-2025-494636.5Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a dis CVE-2025-494646.5Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.CVE-2025-494665.8aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment CVE-2025-494679.3A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL CVE-2025-494688.6A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenti