Use-After-Free in Zoom Client Annotator Enables Participant-to-Participant RCE
CVSS 3.1
8.3high
EPSS
<1%p44
Published
()
Modified
AI analysis
CVE-2026-53415 is a use-after-free vulnerability (CWE-416) in the annotator function of Zoom Clients, scored 8.3 (High) with a network attack vector and changed scope. It is triggered when one meeting participant sends crafted annotation input that another participant's Zoom client processes, allowing an attacker in the meeting to corrupt memory in a fellow attendee's client; the CVSS vector marks user interaction as required and attack complexity as high, while press coverage describes the flaw as zero-click for the victim. A successful attack yields remote code execution on the other participant's client, with high impact to confidentiality, integrity, and availability. Anyone using Zoom Clients who joins meetings with untrusted participants where annotation is available is potentially affected. Exploitation status: not in CISA KEV, no public PoC, EPSS estimates only a 0.5% probability of exploitation in the next 30 days (44th percentile), and Zoom has already patched the flaw.
What to do: Update all Zoom desktop and mobile clients to the latest patched release per Zoom's advisory for CVE-2026-53415 (the source data does not list specific fixed version numbers). As an interim mitigation, restrict or disable participant annotation in meeting settings, and prioritize updates for users who routinely join meetings with external or untrusted participants. Check Zoom's bulletin for the fixed version applicable to each client platform in your fleet.
Affected
Zoom Clients (annotator function)
—
Estimated exposure
mass≥100M users (Zoom's global client install base) — Zoom's client install base spans hundreds of millions of regular meeting participants, and any user who joins meetings with annotation enabled against untrusted participants is exposed; the deployed base vulnerable before the patch is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
A Security researchers disclosed three Zoom annotation flaws enabling zero-click client hijacking; Zoom shipped fixes in June and July with no exploitation reported.
Researchers at A Security found three flaws in Zoom's annotation feature: CVE-2026-53413 (CVSS 8.3, buffer over-write), CVE-2026-53414 (CVSS 6.5, buffer over-read), and CVE-2026-53415 (CVSS 8.3, use-after-free). A crafted drawing object sent over the wrong message channel can overwrite adjacent memory and hijack another attendee's client with no user interaction. Fixes shipped in Zoom Workplace 7.1.5/7.0.6, VDI Client 7.0.11/6.6.16, and Zoom Rooms/Meeting SDK 7.1.0+ during June and July. No exploitation has been reported and the flaws are absent from CISA's Known Exploited Vulnerabilities catalog.
Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.
Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.