Zoom Workplace VDI CVE-2025-64740

Requires an already-authenticated local user on a Windows host running the Zoom Workplace VDI Client, plus the ability to trigger or influence the client's installer/updater, which performs improper cryptographic signature verification (CWE-347) of an installation component - the attacker must be positioned to supply or replace that component in the path the installer trusts. Exploitation is LIMITED by: no remote vector (AV:L, local access mandatory), a valid low-privilege account required (PR:L, not unauthenticated), and the narrow footprint of the VDI-specific client rather than the general Zoom desktop app. No user interaction by a separate victim is required (UI:N).

Signals are internally consistent and point to a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) establishes that an attacker must already have local access and valid low-privilege credentials, which is why the score is HIGH on impact (C/I/A all High) but not CRITICAL - the AV:L and PR:L requirements are meaningful gating factors. The EPSS probability is 0.01% (1st percentile), among the lowest possible, reflecting that unauthenticated remote mass-exploitation is not feasible for a local installer flaw. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. SSVC framing: exploitation = none observed, automatable = no (requires local authenticated presence and likely user-initiated install/update flow), technical impact = total (SYSTEM-level code execution). Net: a legitimate patch-worthy local EoP on a specific client, prioritized by exposure of the affected VDI endpoints, not an emergency. No conflicting signals were found between the CVSS vector and the description - both agree on local, authenticated access.

A logged-in standard user on a Windows VDI endpoint running the Zoom Workplace VDI Client triggers the installer/updater, which fails to properly verify the cryptographic signature of an installation component, allowing the attacker to substitute an attacker-controlled payload that executes with the installer's elevated (SYSTEM) privileges. No public proof-of-concept has been identified; exploitation requires prior local access and valid low-level credentials, and the attacker needs the ability to influence the file or path the installer consumes.