CVE-2025-49457

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-494586.5Buffer overflow in certain Zoom Workplace Clients may allow an authenticated user to conduct a denial of service via network access.CVE-2025-494597.8Missing authorization in the installer for Zoom Workplace for Windows on ARM before version 6.5.0 may allow an authenticated user to conductCVE-2025-49468.1The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_acCVE-2025-494607.5Uncontrolled resource consumption in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via netCVE-2025-494617.4Cross-site scripting in certain Zoom Workplace Clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2025-494623.5Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information viCVE-2025-494636.5Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disCVE-2025-494646.5Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access.CVE-2025-494665.8aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachmentCVE-2025-494679.3A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL CVE-2025-494688.6A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authentiCVE-2025-49476.5libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL
CVE-2025-49457: High severity, CVSS 8.8 | Vulnix