Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution
Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.
Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.
- Remotely triggerable stack buffer overflow; wire-controlled count overruns fixed 128-byte buffers
- Affects Zoom clients on all supported platforms including Windows, macOS, iOS, Android, and Linux
- Researchers ranked 3,762 functions across 70 libraries before dynamic tracing identified libannotate.so
- Server-side mitigation plus client patches in Workplace 7.1.5/7.0.6, Rooms and SDK 7.1.5
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-53413 | Out-of-Bounds Write in Zoom Clients Enables Participant-to-Participant RCE Zoom has fixed an out-of-bounds write (CWE-787) in the annotator function of its client applications, tracked as CVE-2026-53413. A meeting participant can trigger the missing bounds check remotely through the annotation feature, causing a buffer over-write in another attendee's client; per the CVSS vector, user interaction and high attack complexity are required. Successful exploitation may allow the attacker to execute code on the victim's machine with that user's privileges, effectively hijacking another participant's client from within the same meeting. Anyone running a vulnerable Zoom Client (the platform's desktop and mobile apps, used by an extremely large user base) is potentially affected until patched. There is no public proof-of-concept, the flaw is not yet in CISA's KEV catalog, and no exploitation in the wild is known, though an EPSS of 5.6% (92nd percentile) indicates meaningful exploitation potential. Do: Update Zoom Clients to the patched release identified in Zoom's advisory for CVE-2026-53413 and verify installed client versions across managed endpoints. Until patched, limit annotation privileges in meetings to trusted participants and treat meetings with untrusted external attendees as elevated risk. Monitor Zoom's advisory for exact affected/fixed version ranges, since no public PoC exists but EPSS suggests elevated exploitation likelihood. | 8.3 | 6% |
| masswell over 1,000,000 users | ||
| CVE-2026-53414 | Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access. NVD description · AI analysis pending | 6.5 | <1% | — | — | ||
| CVE-2026-53415 | Use-After-Free in Zoom Client Annotator Enables Participant-to-Participant RCE CVE-2026-53415 is a use-after-free vulnerability (CWE-416) in the annotator function of Zoom Clients, scored 8.3 (High) with a network attack vector and changed scope. It is triggered when one meeting participant sends crafted annotation input that another participant's Zoom client processes, allowing an attacker in the meeting to corrupt memory in a fellow attendee's client; the CVSS vector marks user interaction as required and attack complexity as high, while press coverage describes the flaw as zero-click for the victim. A successful attack yields remote code execution on the other participant's client, with high impact to confidentiality, integrity, and availability. Anyone using Zoom Clients who joins meetings with untrusted participants where annotation is available is potentially affected. Exploitation status: not in CISA KEV, no public PoC, EPSS estimates only a 0.5% probability of exploitation in the next 30 days (44th percentile), and Zoom has already patched the flaw. Do: Update all Zoom desktop and mobile clients to the latest patched release per Zoom's advisory for CVE-2026-53415 (the source data does not list specific fixed version numbers). As an interim mitigation, restrict or disable participant annotation in meeting settings, and prioritize updates for users who routinely join meetings with external or untrusted participants. Check Zoom's bulletin for the fixed version applicable to each client platform in your fleet. | 8.3 | <1% |
| mass≥100M users (Zoom's global client install base) |
Full article560 words · extracted from securityaffairs.com · click to collapse
Zoom patches a zero-click flaw that could let a meeting participant execute code on another user’s computer through the annotation feature.
Zoom has patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413, in its annotation feature. CVE-2026-53413 is a memory corruption issue found by A Security that could allow a meeting participant to execute code on another participant’s computer.
Due to its impact, the researchers dubbed the flaw “Zoomsday,” it affects Zoom clients on all supported platforms and is linked to the proprietary protocol used by the annotation function. Zoom has now begun rolling out security updates to address the issue.
“Ⓐ Security, the Autonomous Offensive Security and Remediation Platform, discovered a critical flaw in Zoom that let an attacker take complete control of another user’s device during a live call. No click, no download, and nothing required of the victim but being in the meeting.” reads the report published by A Security. “The vulnerability is present in every version of Zoom on every device and operating system: Windows, Mac, iPhone, Android and Linux. The vulnerability exists in all versions up to and including 7.0.5.”
The flaw can corrupt memory through a specially crafted message. Attackers could exploit it to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.
“A Research was able to exploit the fact that every Zoom client automatically parses whatever it receives, sending a specially crafted message to corrupt the receiving client’s memory and run code on it.” continues the advisory. “The protocol opens a direct channel between a viewer and a sharer, letting the attacker target each participant individually.”
Attackers could join or host a Zoom meeting and silently take control of participants’ devices without any user interaction. Once compromised, they could steal data, activate microphones or cameras, or install malware. In large meetings, a single malicious message could expose multiple participants at once.
Zoom’s Android client was chosen as a target because it is closed-source, widely deployed, and exposes a large native-code attack surface. Researchers first ranked 3,762 functions across 70 libraries, but found the JNI-focused approach missed remotely reachable code. Dynamic tracing instead identified libannotate.so and its proprietary annotation protocol.
Reverse engineering showed that annotation objects are serialized and rebuilt from attacker-controlled network data without adequate origin checks. Researchers discovered CVE-2026-53413, a remotely triggerable stack buffer overflow in CAnnoFormatBlock::Deserialize. A wire-controlled count can exceed fixed 128-byte buffers, allowing data to overwrite adjacent memory. The flaw can be reached through Zoom’s normal encrypted transport, requiring no victim interaction or instrumentation.
A Security also found CVE-2026-53414, a missing bounds check in Zoom’s annotator that can cause a buffer overread and crash a meeting participant’s client, enabling DoS attacks. It also identified CVE-2026-53415, a use-after-free flaw, but Zoom had already discovered the issue before A Security reported it.
“Because a zero-click RCE requires no user interaction, we prioritized giving customers time to receive both the client patch and the server-side mitigation before publishing.” concludes the report. “This post follows that coordinated timeline, and we are releasing it alongside CVE assignment,” A Security notes.
This week, Zoom released Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms to address the above vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zoomsday)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/197042/hacking/zoom-patches-zoomsday-zero-click-flaw-enabling-remote-code-execution.html