Zoom has rolled out patches for four newly disclosed security flaws that could let a malicious meeting participant remotely execute code on another attendee’s computer, with no clicks, downloads, or warning signs required.
The most severe of the bugs, tracked as CVE-2026-53413, has been dubbed “Zoomsday” by A Security, the research team credited with discovering it, and carries a “high” severity rating from Zoom’s own Trust and Security team.
The flaw lives inside Zoom’s annotation feature, the tool that lets meeting participants draw, highlight, or add text while a screen is being shared. That feature relies on a proprietary protocol that opens a direct communication channel between whoever is sharing their screen and whoever is viewing it.
Researchers found that the routine responsible for parsing text-annotation formatting data, called CAnnoFormatBlock::Deserialize, contains several fixed-size 128-byte buffers but blindly trusts 32-bit character counts sent over the network.
Because the client never validates that incoming data actually fits inside those buffers, an attacker can transmit an oversized crafted message that overflows the buffer and corrupts adjacent memory, ultimately hijacking the program’s control flow to run arbitrary code.
A Security researcher demonstrated the exploit on macOS by using it to silently launch the Safari browser on a victim’s machine, proving that full code execution is achievable with no user interaction and no visible sign of compromise, since the attacker only needs to join or host a meeting and target any participant individually.
Alongside CVE-2026-53413, Zoom disclosed three related issues in the same bulletin cycle. CVE-2026-53414, rated medium severity, is a buffer over-read bug in Zoom Clients that can leak memory contents.
CVE-2026-53415 is a use-after-free vulnerability, also rated high, that can lead to memory corruption and potential code execution if an attacker triggers access to freed memory.
CVE-2026-53416 affects Zoom’s Virtual Desktop Infrastructure (VDI) Client and stems from a path traversal weakness, rated high, that could expose sensitive files by letting an attacker manipulate file paths outside intended directories. Zoom tracks these under bulletins ZSB-26015 through ZSB-26018, all published and updated on August 11, 2026.
Zoom says the annotation-related bugs affect its clients across all supported platforms, while the path traversal issue is specific to VDI deployments.
Fixes are already available: Zoom Workplace versions 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5 resolve the annotation flaws, while Workplace VDI Client versions 7.0.11 and 6.6.16, along with VDI Plugin versions 7.0.11 and 6.6.15, patch the path traversal bug.
Zoom has not reported evidence of active exploitation in the wild, and no public proof-of-concept exploit is currently circulating. Even so, security teams and everyday users alike should treat this as an urgent patching priority, since the annotation flaw requires zero interaction from the victim and leaves no visual trace of compromise.
Organizations managing centralized Zoom deployments should push updated installer packages immediately rather than relying on individual users to update manually, to avoid vulnerable builds silently reappearing on the next install cycle.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now
