Zoom has patched four security vulnerabilities that could allow a malicious meeting participant to remotely execute code, crash another attendee’s client, or access sensitive files.
The most serious issue, CVE-2026-53413, has been dubbed “Zoomsday” by A Security, the research team that discovered the flaw.
It affects Zoom’s annotation engine and can be exploited without requiring the victim to click a link, accept a prompt, download a file, or take any visible action beyond joining a meeting.
Zoom Zero-Click Flaw
Zoom rated CVE-2026-53413 as high severity, assigning it a CVSS score of 8.3. The company said the vulnerability is caused by a missing bounds check in the annotation function of Zoom Clients.
A remote participant could exploit the issue through network access to execute code on another participant’s system. The weakness is particularly concerning because annotation data is automatically processed by the receiving Zoom client during a screen-sharing session.
The vulnerable feature allows participants to draw, highlight, and insert text over a shared screen. Behind the interface, Zoom uses a proprietary protocol to exchange annotation objects between the meeting participant sharing content and those viewing it.
CSN stated that this architecture creates a direct communication channel between viewers and presenters, enabling an attacker to send crafted annotation data to a selected participant.
A security analysis identified the affected routine as CAnnoFormatBlock::Deserialize, which processes formatting information for text annotations.
The function contains fixed-size 128-byte buffers but accepts 32-bit character counts received from the network. Because the client does not reliably confirm that an incoming value fits within the destination buffer, a malicious participant could trigger a buffer overwrite and corrupt adjacent memory.
In a successful exploitation scenario, that memory corruption could alter the application’s control flow and enable arbitrary code execution.
Researchers demonstrated the issue on macOS by silently launching Safari on a victim device. The proof of concept showed that the attack could execute code without any victim-facing warning inside the meeting.
While the public demonstration launched a browser, the risk extends beyond that limited action: a successful remote code execution vulnerability can potentially be used to run malware, collect data, establish persistence, or access device resources under the permissions of the compromised Zoom client.
Zoom disclosed three additional issues alongside the Zoomsday flaw. CVE-2026-53414 is a medium-severity buffer overflow in the annotation component that may enable a participant to cause a denial-of-service condition.
CVE-2026-53415 is a high-severity use-after-free vulnerability in the annotator function that may also lead to remote code execution.
CVE-2026-53416 is a high-severity path traversal flaw affecting Zoom Workplace VDI Client and VDI Plugins, potentially enabling an authenticated local attacker to access files outside intended directories.
The annotation-related flaws affect Zoom clients across supported platforms, while the path traversal issue is specific to VDI deployments. Zoom’s bulletins identify patched releases including Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Zoom Meeting SDK 7.1.5.
VDI users should move to Zoom Workplace VDI Client 7.0.11 or 6.6.16 and VDI Plugin 7.0.11 or 6.6.15, depending on their supported branch.
Zoom has not reported active exploitation, and no public weaponized proof of concept is known to be circulating. However, organizations should treat the flaws as an urgent patching priority.
Administrators should centrally deploy updated Zoom packages, enforce minimum versions via endpoint management tools, update gold images, and investigate any unusual processes launched by Zoom clients.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
