# Zoom macOS installer flaw enables root escalation

Published: 2026-08-02 · Severity: medium
Canonical: https://vorant.io/reports/f6754187-39b9-5fa2-abc9-8858dc2146d7/zoom-macos-installer-flaw-enables-root-escalation

> Researcher Patrick Wardle found local privilege-escalation and library-injection bugs in Zoom's macOS client, letting attackers gain root or silently record mic/camera.

Security researcher Patrick Wardle detailed two local security issues in the macOS version of Zoom, discovered while investigating the app's use of the deprecated AuthorizationExecuteWithPrivileges API. The first issue is a race-condition-style privilege escalation: Zoom's installer copies a bash script (runwithroot) to a world-writable temporary directory before executing it as root via security_authtrampoline, allowing any local unprivileged user or malware to subvert the script and gain root access during install or upgrade.

The second issue stems from Zoom's Hardened Runtime entitlements, which include com.apple.security.cs.disable-library-validation. This exception permits arbitrary, unsigned libraries to be loaded into Zoom's process space, defeating the protections Hardened Runtime is meant to provide. Wardle demonstrated 'dylib proxying' — replacing a legitimate library (libssl.1.0.0.dylib) with a malicious proxy that re-exports the original functionality — to inject code into Zoom that inherits the app's user-approved microphone and camera access, enabling covert audio/video recording or silent background launches (via 'open -j') without triggering macOS's privacy prompts.

The post also recaps Zoom's broader track record of security/privacy issues (the 2019 camera-hijack 0day and hidden local web server forcibly removed by Apple's Malware Removal Tool, and iOS-to-Facebook data leakage), framing these new findings as consistent with a pattern of weak security engineering. No CVE identifiers are cited; the issues were disclosed directly via the blog with no confirmed in-the-wild exploitation, though Wardle recommends detection tools (OverSight, KnockKnock) as mitigation given Zoom's surge in enterprise use during pandemic-driven remote work.

Source reporting: https://objective-see.org/blog/blog_0x56.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f6754187-39b9-5fa2-abc9-8858dc2146d7/zoom-macos-installer-flaw-enables-root-escalation.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup