Zoom and Xerox have announced critical security updates to address significant vulnerabilities in their software that could lead to privilege escalation and remote code execution. The vulnerabilities affect various Windows-based applications, with Zoom's CVE-2025-49457 carrying a CVSS score of 9.6, indicating a high level of severity. According to Zoom, the flaw allows unauthenticated users to exploit an untrusted path in certain versions of Zoom Clients for Windows. Affected products include Zoom Workplace for Windows, Zoom Rooms, and the Zoom Meeting SDK, specifically versions prior to 6.3.10. The company stated, "Untrusted path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access." The issue was first identified by Zoom's Offensive Security team, who reported it internally before the public disclosure on August 13, 2025.
In addition to Zoom's vulnerabilities, Xerox has disclosed critical issues in its FreeFlow Core software, particularly CVE-2025-8356, which has a CVSS score of 9.8 due to its potential for remote code execution through a path traversal vulnerability. Xerox has made updates available in version 8.0.4 to resolve these issues. The vulnerabilities were noted as being "rudimentary to exploit" and could allow attackers to execute arbitrary commands on the affected systems if left unaddressed.
The technical details of the CVE-2025-49457 vulnerability indicate that it stems from an untrusted path issue where the application searches for critical files or libraries in locations that could be manipulated. Exploiting this flaw enables attackers to escalate privileges without user interaction, posing a significant threat to system security. The affected versions include Zoom Workplace for Windows before version 6.3.10 and Zoom Rooms Controller for Windows before the same version, while exceptions are noted for versions 6.1.16 and 6.2.12.
In response, both companies have urged users to update their software immediately to mitigate potential exploitation. Xerox emphasized the urgency of applying the security patches, stating, "These vulnerabilities could lead to severe consequences if exploited." The security community has reacted swiftly, with many organizations implementing measures to ensure users are aware of the necessary updates. Cybersecurity professionals recommend that organizations conduct audits to identify any unpatched systems and apply the latest versions without delay.
In conclusion, users of affected Zoom and Xerox products should prioritize updating to the latest versions to safeguard against these critical vulnerabilities. As emphasized by industry experts, timely patching is essential to maintain security in the face of evolving threats.