Zoom Patches Critical Zero-Click RCE Vulnerability in Annotation Feature
Zoom has released patches for a critical zero-click remote code execution vulnerability affecting its annotation feature, allowing attackers to take over meeting participants' machines.
Zoom has addressed a severe security flaw within its widely-used video conferencing platform, patching a critical zero-click remote code execution (RCE) vulnerability tied to its annotation feature. The vulnerability, discovered by security firm A Security and dubbed "Zoomsday," allowed a malicious meeting participant to execute arbitrary code on another attendee's machine without any user interaction or warning.
The exploit leveraged a proprietary protocol used by Zoom's annotator function, which establishes a direct communication channel between meeting participants. By sending a specially crafted message, an attacker could corrupt the memory of a targeted client, leading to code execution. This bypasses the need for any user action, such as clicking a link or opening a file, making it a particularly dangerous threat.
A Security detailed how a missing bound check in the text annotator component was the root cause of the RCE. This oversight allowed an attacker to write malicious code beyond the intended buffer space, effectively hijacking the victim's system. The firm emphasized that the exploit could be used by an attacker who either joined or hosted a meeting, enabling them to target any participant individually.
Beyond the critical RCE flaw (CVE-2026-53413), A Security also identified two other vulnerabilities within the annotator function. CVE-2026-53414, another missing bound check, could be exploited to cause a denial-of-service (DoS) attack, disrupting meeting functionality. Additionally, a use-after-free vulnerability (CVE-2026-53415) was found, though Zoom had already discovered this issue internally.
Zoom has released updates across its various products to mitigate these threats. Versions 7.1.5 and 7.0.6 of Zoom Workplace clients, along with corresponding versions of Zoom Rooms and Meeting SDK, now include fixes for the annotation-related vulnerabilities on all supported platforms. The company also addressed a separate path traversal flaw (CVE-2026-53416) impacting its VDI clients and plugins.
While the RCE vulnerability was critical, A Security opted to delay its public disclosure until Zoom had deployed patches and server-side mitigations. This coordinated disclosure approach aims to give users sufficient time to update their software, minimizing the window of opportunity for exploitation.
This incident highlights the ongoing risks associated with complex collaboration tools and the importance of robust security practices. Features like annotation, while useful for real-time collaboration, can become attack vectors if not properly secured. Users are strongly advised to update their Zoom clients to the latest versions to protect themselves from this critical zero-click vulnerability.
Further details on the resolved vulnerabilities can be found on Zoom's official security bulletins page.
This new report details three additional vulnerabilities alongside the critical CVE-2026-53413 "Zoomsday" flaw. These include CVE-2026-53414, a medium-severity buffer over-read that can leak memory contents, CVE-2026-53415, a high-severity use-after-free bug potentially leading to code execution, and CVE-2026-53416, a high-severity path traversal vulnerability affecting Zoom's VDI client that could expose sensitive files.