Zoom Patches Critical Zero-Click RCE Vulnerability in Annotation Feature
Zoom has released patches for a critical zero-click remote code execution vulnerability affecting its annotation feature, allowing attackers to take over meeting participants' machines.
Zoom has addressed a severe security flaw within its widely-used video conferencing platform, patching a critical zero-click remote code execution (RCE) vulnerability tied to its annotation feature. The vulnerability, discovered by security firm A Security and dubbed "Zoomsday," allowed a malicious meeting participant to execute arbitrary code on another attendee's machine without any user interaction or warning.
The exploit leveraged a proprietary protocol used by Zoom's annotator function, which establishes a direct communication channel between meeting participants. By sending a specially crafted message, an attacker could corrupt the memory of a targeted client, leading to code execution. This bypasses the need for any user action, such as clicking a link or opening a file, making it a particularly dangerous threat.
A Security detailed how a missing bound check in the text annotator component was the root cause of the RCE. This oversight allowed an attacker to write malicious code beyond the intended buffer space, effectively hijacking the victim's system. The firm emphasized that the exploit could be used by an attacker who either joined or hosted a meeting, enabling them to target any participant individually.
Beyond the critical RCE flaw (CVE-2026-53413), A Security also identified two other vulnerabilities within the annotator function. CVE-2026-53414, another missing bound check, could be exploited to cause a denial-of-service (DoS) attack, disrupting meeting functionality. Additionally, a use-after-free vulnerability (CVE-2026-53415) was found, though Zoom had already discovered this issue internally.
Zoom has released updates across its various products to mitigate these threats. Versions 7.1.5 and 7.0.6 of Zoom Workplace clients, along with corresponding versions of Zoom Rooms and Meeting SDK, now include fixes for the annotation-related vulnerabilities on all supported platforms. The company also addressed a separate path traversal flaw (CVE-2026-53416) impacting its VDI clients and plugins.
While the RCE vulnerability was critical, A Security opted to delay its public disclosure until Zoom had deployed patches and server-side mitigations. This coordinated disclosure approach aims to give users sufficient time to update their software, minimizing the window of opportunity for exploitation.
This incident highlights the ongoing risks associated with complex collaboration tools and the importance of robust security practices. Features like annotation, while useful for real-time collaboration, can become attack vectors if not properly secured. Users are strongly advised to update their Zoom clients to the latest versions to protect themselves from this critical zero-click vulnerability.
Further details on the resolved vulnerabilities can be found on Zoom's official security bulletins page.
This new report details three additional vulnerabilities alongside the critical CVE-2026-53413 "Zoomsday" flaw. These include CVE-2026-53414, a medium-severity buffer over-read that can leak memory contents, CVE-2026-53415, a high-severity use-after-free bug potentially leading to code execution, and CVE-2026-53416, a high-severity path traversal vulnerability affecting Zoom's VDI client that could expose sensitive files.
This new report from A Security provides a deeper technical dive into the Zoom annotation flaws, detailing how a malformed drawing object can overwrite return addresses and bypass security checks. The researchers claim to have developed a working exploit in under a day, leveraging publicly available AI models, and rate the vulnerabilities significantly higher than Zoom's own assessments under CVSS 4.0, particularly highlighting the zero-click nature of the exploitation.
The newly disclosed "Zoomsday" vulnerabilities (CVE-2026-53413, CVE-2026-53414, CVE-2026-53415) specifically target Zoom's annotation processing, allowing a malicious participant to crash clients, leak information, or execute arbitrary code. While the existing story notes a critical zero-click RCE, these new CVEs detail the specific mechanism within the annotation parser and highlight a discrepancy in severity ratings between researchers and Zoom, with the latter rating them as High due to requiring user interaction, such as joining a meeting with malicious intent.
This new report from GovInfoSecurity highlights that the vulnerabilities patched by Zoom allow for zero-click remote code execution, meaning attackers can infect participants simply by initiating a malicious meeting invitation. The exploit does not require any user interaction, such as clicking a link or downloading a file, making it particularly dangerous for all attendees on a compromised call.
Zero Day Initiative has disclosed ZDI-26-604, a use-after-free vulnerability in Foxit PDF Reader's annotation handling that allows for remote code execution. This new advisory details a CVSS 7.8 vulnerability that requires user interaction, such as opening a malicious file or visiting a malicious webpage, to be exploited.