Zoom released patches on Aug. 11 for four vulnerabilities, three of which form an exploit chain in the company’s annotation feature that allows one meeting participant to execute code on another participant’s machine. The security firm A Security, which reported the chain, has designated it ZOOMSDAY.
According to A Security’s disclosure, a single engineer discovered the vulnerabilities and developed a working exploit in less than 24 hours using fewer than 20 prompts against publicly available AI models. The firm states that comparable work would previously have required a team of approximately five people working for around six months.
The vulnerabilities are in Zoom’s annotator, the feature allowing meeting participants to draw, highlight, and type over a shared screen. The annotator uses a proprietary protocol that opens a direct channel between the participant sharing a screen and each individual viewer, making participants individually addressable rather than recipients of a broadcast stream. Zoom clients automatically parse data received on that channel.
The chain affects Zoom clients on Windows, macOS, Linux, iOS, and Android.
CVE-2026-53413 is a buffer over-write in the annotator. Zoom’s text-annotation deserialization allocated fixed-size buffers without validating the length field declared in the incoming packet, allowing attacker-supplied data to be written past the intended buffer. Zoom rates it 8.3, high severity.
CVE-2026-53414 is a buffer over-read. Zoom allocates a memory buffer based on the character count specified in an incoming packet even when the packet contains less data than that count indicates, returning adjacent memory contents. Zoom rates it 6.5, medium severity.
CVE-2026-53415 is a use-after-free affecting how Zoom processes annotation messages carrying auto-shape metadata. According to A Security, Zoom’s parser read attacker-controlled data into an internal linked-list structure without validating the supplied pointers, producing a write-what-where condition. Zoom rates it 8.3, high severity. Zoom credits its own offensive-security team with independently identifying this flaw.
The over-read is not incidental to the chain. The memory it returns exposes layout information used to defeat memory protections, converting an unreliable overwrite into reliable remote code execution.
A Security scores all three vulnerabilities at 9.0, critical severity, higher than Zoom’s own ratings. A further discrepancy exists in the advisories: Zoom’s bulletins mark user interaction as required, which differs from A Security’s characterisation of the chain as zero-click. A Security states that an attacker can join or host a meeting, target any participant, and take control of that participant’s machine with no action required from the victim and no visual indication of compromise.
Fixes for the three annotator vulnerabilities are available in:
– Zoom Workplace 7.1.5 and 7.0.6
– Zoom Rooms 7.1.5
– Meeting SDK 7.1.5
Zoom separately patched CVE-2026-53416, a path traversal flaw leading to information disclosure, in:
– Workplace VDI Client for Windows 7.0.11 and 6.6.16
– Workplace VDI Plugins 7.0.11 and 6.6.15
Full details are published on Zoom’s security bulletins page. Organizations that pin client versions for stability will need to schedule an exception; the specific justification is CVE-2026-53413, rated high severity by the vendor and critical by the reporting firm, exploitable by any meeting participant against any other participant.
Leave a Reply