CVE-2025-30663
📋 TL;DR
A time-of-check time-of-use race condition vulnerability in Zoom Workplace Apps allows authenticated local users to escalate privileges. This affects users running vulnerable versions of Zoom Workplace Apps on their local systems. Attackers must have local access and authentication to exploit this vulnerability.
💻 Affected Systems
- Zoom Workplace Apps
📦 What is this software?
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Rooms by Zoom
Workplace Virtual Desktop Infrastructure by Zoom
View all CVEs affecting Workplace Virtual Desktop Infrastructure →
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains full system-level privileges, potentially compromising the entire local system and accessing sensitive data or installing persistent malware.
Likely Case
Local authenticated users escalate to higher privileges within the Zoom application context, potentially accessing other user data or system resources they shouldn't have access to.
If Mitigated
With proper access controls and patching, the impact is limited to the local user's own session with no privilege escalation.
🎯 Exploit Status
Exploitation requires authenticated local access and precise timing to win the race condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Zoom security bulletin ZSB-25016 for patched versions
Vendor Advisory: https://www.zoom.com/en/trust/security-bulletin/zsb-25016
Restart Required: Yes
Instructions:
1. Open Zoom Workplace Apps. 2. Go to Settings > About. 3. Check for updates or download latest version from zoom.us/download. 4. Install update. 5. Restart the application.
🔧 Temporary Workarounds
Restrict local user privileges
allLimit standard user privileges to reduce impact of potential privilege escalation
Disable unnecessary Zoom features
allReduce attack surface by disabling non-essential Zoom Workplace features
🧯 If You Can't Patch
- Implement strict least-privilege access controls for all users
- Monitor for unusual privilege escalation attempts using endpoint detection tools
🔍 How to Verify
Check if Vulnerable:
Check Zoom version in Settings > About and compare against patched versions in ZSB-25016Check Version:
On Windows: Get-ItemProperty 'HKLM:\Software\ZoomUMX' | Select-Object Version; On macOS: /Applications/zoom.us.app/Contents/Info.plist | grep CFBundleVersion; On Linux: dpkg -l | grep zoom or rpm -qa | grep zoomVerify Fix Applied:
Verify Zoom version is updated to patched version listed in ZSB-25016📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation events in system logs
- Multiple rapid file access attempts by Zoom process
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
EventID=4688 OR EventID=4624 with Zoom process name and privilege changes on Windows; auth.log privilege escalation events on Linux