The Zoom Rooms installer for Windows contains an untrusted search path flaw that allows an authenticated user to elevate privileges on the local machine. This weakness is a classic example of CWE-426, where a program searches for executables in an insecure order, potentially loading a malicious file instead of the intended one. An attacker who can run the installer normally can supply a forged executable in a higher‑priority location (e.g., a directory with a higher precedence in the system PATH) and force the installer to execute it, thereby gaining administrative rights within the same user session.

Zoom Communications Windows Zoom Rooms installations with versions earlier than 7.0.0 are vulnerable. Any user who can authenticate locally and launch the Zoom Rooms installer is at risk. The issue does not affect other Zoom products or remote installations.

The CVSS score of 7.8 indicates high severity, reflecting the potential for privilege escalation and subsequent complete control over the affected system. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of a zero‑day exploit at present is unclear; however, the local nature of the flaw means that an insider or compromised local account could exploit it. Because the attacker only needs local authenticated access, the attack vector is straightforward but requires the ability to run installers.