Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
A Security researchers disclosed three Zoom annotation flaws enabling zero-click client hijacking; Zoom shipped fixes in June and July with no exploitation reported.
Researchers at A Security found three flaws in Zoom's annotation feature: CVE-2026-53413 (CVSS 8.3, buffer over-write), CVE-2026-53414 (CVSS 6.5, buffer over-read), and CVE-2026-53415 (CVSS 8.3, use-after-free). A crafted drawing object sent over the wrong message channel can overwrite adjacent memory and hijack another attendee's client with no user interaction. Fixes shipped in Zoom Workplace 7.1.5/7.0.6, VDI Client 7.0.11/6.6.16, and Zoom Rooms/Meeting SDK 7.1.0+ during June and July. No exploitation has been reported and the flaws are absent from CISA's Known Exploited Vulnerabilities catalog.
- CVE-2026-53413 (CVSS 8.3) buffer over-write and CVE-2026-53414 (CVSS 6.5) over-read; researcher-rated 9.0 under CVSS 4.0
- Malformed drawing object accepted without origin check overruns a fixed 128-byte buffer
- Fixes shipped in Workplace 7.1.5/7.0.6, VDI 7.0.11/6.6.16, Rooms and SDK 7.1.0+
- No exploitation reported; none of the three identifiers appear in CISA's KEV catalog
- A Security claims the exploit was built in under a day using fewer than 20 prompts on public AI models
- Vendors
- Zoom
- Products
- Zoom Workplace
- Organizations
- A SecurityCISAOpenAI
- AI models
- GPT-5.6-Cyber
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-53413+1 related CVE | Out-of-Bounds Write in Zoom Clients Enables Participant-to-Participant RCE | 8.3 | 6% | ||
| CVE-2026-53414 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on… | 6.5 | <1% |
From the original article
4 min read at thehackernews.com
Swati Khandelwal Aug 11, 2026 Vulnerability / Software Security Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's. The flaw sat in the annotation tool, the feature that lets participants draw and type on a shared screen, and it asked nothing of the victim beyond being in the meeting.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.