CVE-2025-64740: 
Zoom VDI Client vulnerability analysis and mitigation

CVE-2025-64740 is an improper verification of cryptographic signature vulnerability (CWE-347) in the installer for Zoom Workplace VDI (Virtual Desktop Infrastructure) Client for Windows. It may allow an authenticated local user to conduct privilege escalation via local access. Affected versions include Zoom Workplace VDI Client for Windows prior to 6.3.14 and versions 6.4.10 through 6.4.12 (excluding 6.4.12). The vulnerability was disclosed by Zoom on November 11, 2025, and published to NVD on November 13, 2025. The CVSS v3.1 base score is 7.8 (High) per NVD, and 7.5 (High) per Zoom's own CNA assessment (Zoom Advisory, NVD).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature), meaning the Zoom Workplace VDI Client installer for Windows fails to properly validate cryptographic signatures on components it processes or executes during installation. This flaw can be abused by an authenticated local user to substitute or tamper with installer components that are not properly signature-checked, enabling execution of malicious code with elevated privileges. The attack vector is local (AV:L), requires low privileges (PR:L), and has low attack complexity (AC:L) per NVD's assessment, indicating that exploitation does not require sophisticated techniques beyond local access. No public proof-of-concept code has been identified at this time (Zoom Advisory, NVD).

Successful exploitation allows an authenticated local attacker to escalate privileges on the affected Windows system, with high impact to confidentiality, integrity, and availability. An attacker who gains elevated privileges could access sensitive data, modify system configurations, install persistent malware, or disrupt services running on the VDI client host. In VDI environments, where multiple users may share infrastructure, privilege escalation could have broader consequences including lateral movement to other virtual sessions or backend systems (Zoom Advisory, NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-64740 as of the available data. The vulnerability has an EPSS score of approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Zoom has released patched versions of the Zoom Workplace VDI Client for Windows. Users should update to version 6.3.14 or later (for the 6.3.x branch) or version 6.4.12 or later (for the 6.4.x branch). Zoom recommends applying the latest updates available at https://zoom.us/download. No specific configuration-based workarounds have been published; upgrading to a fixed version is the primary remediation (Zoom Advisory).

The vulnerability received coverage from several cybersecurity news outlets including CyberSecurityNews, GBHackers, and eSecurity Planet, which highlighted the privilege escalation risk in VDI environments. Rescana published an analysis grouping it alongside other critical privilege escalation vulnerabilities in enterprise software. The Hacker News included it in their weekly recap. Community reaction has been moderate, with no significant controversy or researcher-led technical deep-dives published publicly (CyberSecurityNews, GBHackers, Rescana).