Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution
Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.
Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.
- Remotely triggerable stack buffer overflow; wire-controlled count overruns fixed 128-byte buffers
- Affects Zoom clients on all supported platforms including Windows, macOS, iOS, Android, and Linux
- Researchers ranked 3,762 functions across 70 libraries before dynamic tracing identified libannotate.so
- Server-side mitigation plus client patches in Workplace 7.1.5/7.0.6, Rooms and SDK 7.1.5
- Vendors
- Zoom
- Products
- Zoom Workplace
- Organizations
- A Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-53413+1 related CVE | Out-of-Bounds Write in Zoom Clients Enables Participant-to-Participant RCE | 8.3 | 6% | ||
| CVE-2026-53414 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on… | 6.5 | <1% |
From the original article
2 min read at securityaffairs.com
Zoom patches a zero-click flaw that could let a meeting participant execute code on another user’s computer through the annotation feature. Zoom has patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413, in its annotation feature.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.