An authenticated Windows user can supply arbitrary file names or paths during installation of the Zoom Workplace VDI Plugin, allowing the installer to write files to unintended locations. This external control of file names or paths, identified as CWE‑73 and CWE‑610, can result in local privilege escalation because the plugin may run with higher permissions than the user, enabling the replacement of critical system files or configuration data.

The vulnerability affects Zoom Communications’ Zoom Workplace VDI Plugin distributed via the Windows Universal Installer for versions earlier than 6.6.11.

The CVSS score of 7.8 indicates high severity for an authenticated local user. The EPSS score of < 1% shows a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting no known exploits. The likely attack vector involves a local authenticated Windows user who has installed the plugin; if the attacker can control the installer’s input, they may place malicious files with elevated privileges.