CVE-2026-30905

Executive Summary

CVE-2026-30905 is a high-severity (CVSS 7.8) privilege escalation vulnerability in the Zoom Workplace VDI Plugin Windows Universal Installer. The flaw stems from an External Control of File Name or Path (CWE-73), allowing an authenticated local attacker to manipulate file paths during the installation process. This can lead to arbitrary file writes or overwrites, ultimately enabling escalation of privileges to SYSTEM level. The vulnerability affects all versions prior to 6.6.11. No public exploit code or proof-of-concept is currently available, but the risk is significant for enterprise environments using Zoom VDI.

Supply Chain & Package Security

This vulnerability is specific to the Zoom Workplace VDI Plugin Windows Universal Installer, a proprietary binary distributed via Zoom’s official channels. There is no open-source package (NPM, PyPI, Go, Ruby) involved. The supply chain risk is limited to the integrity of Zoom’s distribution pipeline; however, the lack of a patch at the time of analysis means organizations must rely on manual mitigation until an update is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires physical or remote desktop access.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: Low (PR:L) – attacker needs a valid user account.
• User Interaction: None (UI:N) – no user action required beyond the attacker’s own.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability Impact: All High (C:H/I:H/A:H) – full system compromise.

Threat Level: High. While the attack vector is local, the low complexity and high impact make it a prime target for insider threats or post-exploitation lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the Zoom Workplace VDI Plugin Windows Universal Installer (typically ZoomInstallerFull.msi or a similar executable). The installer fails to properly validate user-supplied input when constructing file paths for installation or configuration files. An authenticated attacker can exploit this by:

1. Manipulating environment variables or command-line arguments passed to the installer.
2. Creating symbolic links or junctions that redirect file writes to privileged locations (e.g., C:\Windows\System32).
3. Leveraging the installer’s high-integrity execution (since it runs with SYSTEM privileges) to overwrite critical system files or DLLs.

The core issue is that the installer uses a user-controllable path without sanitization, allowing an attacker to specify a path like C:\Windows\System32\evil.dll instead of the intended %TEMP%\zoom\plugin.dll. When the installer writes to this path, it executes with SYSTEM privileges, effectively granting the attacker arbitrary file write at the highest integrity level.

Vulnerable vs. Patched Code

Since the patch is not publicly available, the following is a hypothetical comparison based on the CWE-73 pattern.

Vulnerable Code (Pre-6.6.11):

// Pseudocode for vulnerable installer
void InstallPlugin(const std::string& userInputPath) {
    std::string finalPath = "C:\\ProgramData\\Zoom\\Plugins\\" + userInputPath;
    // No validation of userInputPath
    WriteFile(finalPath, pluginData);
}

Patched Code (6.6.11+):

// Pseudocode for patched installer
void InstallPlugin(const std::string& userInputPath) {
    // Validate and sanitize path
    if (!IsValidPath(userInputPath) || ContainsPathTraversal(userInputPath)) {
        throw std::runtime_error("Invalid path");
    }
    std::string finalPath = "C:\\ProgramData\\Zoom\\Plugins\\" + SanitizePath(userInputPath);
    // Ensure final path is within allowed directory
    if (!IsSubdirectory(finalPath, "C:\\ProgramData\\Zoom\\Plugins\\")) {
        throw std::runtime_error("Path escape detected");
    }
    WriteFile(finalPath, pluginData);
}

The patched version adds input validation, path traversal checks, and a subdirectory confinement test.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a Windows machine with Zoom Workplace VDI Plugin < 6.6.11.
• A low-privileged user account.

Exploitation Steps:

1. Identify the installer path: Typically C:\Program Files\Zoom\Plugins\ZoomVDIInstaller.exe or similar.
2. Craft a malicious path: Use a symbolic link or environment variable to redirect output. For example:

   mklink /D C:\Users\Public\ZoomPlugin C:\Windows\System32
   

3. Trigger the installer with the crafted path:

   ZoomVDIInstaller.exe /installpath="C:\Users\Public\ZoomPlugin\evil.dll"
   

4. Result: The installer writes evil.dll to C:\Windows\System32\evil.dll with SYSTEM privileges.
5. Escalate: Use the planted DLL to execute code as SYSTEM (e.g., via DLL hijacking or scheduled task).

Note: No public exploit code exists; this is a theoretical attack path.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual file writes to C:\Windows\System32 or C:\Program Files by the Zoom installer process.
• Alert on creation of symbolic links or junctions by non-admin users.
• Track command-line arguments containing path traversal sequences (..\, ..\\).

Prevention:

• Apply the vendor patch immediately when available.
• Restrict local user permissions to prevent symbolic link creation.
• Use AppLocker or Windows Defender Application Control to block unauthorized DLLs.
• Enable Windows Defender Attack Surface Reduction (ASR) rules for process injection and untrusted executable writes.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_30905_Zoom_VDI_Installer {
    meta:
        description = "Detects exploitation of CVE-2026-30905 via path traversal in Zoom VDI installer"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $s1 = "ZoomVDIInstaller.exe" nocase
        $s2 = "..\\" ascii wide
        $s3 = "System32" ascii wide nocase
        $s4 = "C:\\Windows" ascii wide nocase
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2026-30905 Zoom VDI Installer Path Traversal
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects command-line arguments indicative of path traversal in Zoom VDI installer
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ZoomVDIInstaller.exe'
        CommandLine|contains:
            - '..\\'
            - 'System32'
            - 'C:\\Windows'
    condition: selection
falsepositives:
    - Legitimate administrative use (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30905 Zoom VDI Installer Potential C2"; flow:to_server; content:"ZoomVDIInstaller"; http_user_agent; content:"evil"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Zoom Workplace VDI Plugin version 6.6.11 or later as soon as it is released.
2. Restrict local user permissions – remove write access to C:\Windows\System32 and C:\Program Files for standard users.
3. Disable symbolic link creation for non-admin users via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Create symbolic links.
4. Monitor for the IOCs listed above.

Long-Term Measures:

• Implement application whitelisting (e.g., WDAC) to block unauthorized binaries.
• Conduct regular vulnerability scans for Zoom products.
• Enforce least privilege principles across all endpoints.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.