CVE-2026-53413

Zoom has fixed an out-of-bounds write (CWE-787) in the annotator function of its client applications, tracked as CVE-2026-53413. A meeting participant can trigger the missing bounds check remotely through the annotation feature, causing a buffer over-write in another attendee's client; per the CVSS vector, user interaction and high attack complexity are required. Successful exploitation may allow the attacker to execute code on the victim's machine with that user's privileges, effectively hijacking another participant's client from within the same meeting. Anyone running a vulnerable Zoom Client (the platform's desktop and mobile apps, used by an extremely large user base) is potentially affected until patched. There is no public proof-of-concept, the flaw is not yet in CISA's KEV catalog, and no exploitation in the wild is known, though an EPSS of 5.6% (92nd percentile) indicates meaningful exploitation potential.

What to do: Update Zoom Clients to the patched release identified in Zoom's advisory for CVE-2026-53413 and verify installed client versions across managed endpoints. Until patched, limit annotation privileges in meetings to trusted participants and treat meetings with untrusted external attendees as elevated risk. Monitor Zoom's advisory for exact affected/fixed version ranges, since no public PoC exists but EPSS suggests elevated exploitation likelihood.