Attackers can execute remote code via Zoom annotation tool without user interaction

Summary

Zoom has released patches for four security vulnerabilities affecting its client software across all supported platforms. The most critical of these flaws, dubbed "Zoomsday" by researchers at A Security, enables an attacker to execute arbitrary code on a victim's machine during a meeting. This vulnerability exists within the proprietary protocol used by the Zoom annotator function.

The discovery includes three distinct defects found in the same component: one allowing remote code execution (RCE), one capable of causing a denial-of-service (DoS) attack, and a use-after-free flaw. Additionally, a fourth vulnerability involving path traversal was identified within the Workplace VDI Client.

Technical details

The primary threat, CVE-2026-53413, is a memory corruption issue stemming from a missing bound check in the text annotator. Because the Zoom client automatically parses incoming data through its proprietary protocol, an attacker can send specially crafted messages that write code past the intended buffer.

This flaw creates a direct channel between a meeting viewer and a sharer. An attacker can join or host a meeting and target any individual participant to take over their machine. The exploit requires no action from the victim and provides no visual cues that a compromise is occurring.

Other vulnerabilities discovered in the annotator function include:

• CVE-2026-53414: A missing bound check that allows for buffer overreads, which can be used to trigger a denial-of-service (DoS) attack against participants.
• CVE-2026-53415: A use-after-free flaw discovered by A Security, though Zoom had identified this issue independently prior to the report.

Affected products and fixed versions

Why this matters for defenders

The "Zoomsday" exploit is particularly dangerous because it bypasses the need for a victim to click a link or download a file. The vulnerability resides in how the client handles incoming data via the proprietary protocol used during annotation sessions. This means any participant in a meeting-whether they are hosting or merely viewing-can be targeted.

The attack surface is broad, as the flaw affects all supported platforms for Zoom Workplace and Rooms. For organizations using Virtual Desktop Infrastructure (VDI), the path traversal vulnerability (CVE-2026-53416) presents a separate risk of information disclosure that must also be addressed through updates to the VDI Client and Plugins.

Defender guidance

Prioritize updating all Zoom client software to the versions listed in the table above. Because this is a zero-click vulnerability, traditional user awareness training will not prevent an attack; only the application patch can mitigate the risk.

1. Update Workplace Clients: Ensure all employee workstations are running Workplace version 7.1.5 or 7.0.6.
2. Update Meeting Rooms: Verify that all physical Zoom Room hardware is updated to version 7.1.5.
3. Patch VDI Environments: Update Windows VDI Clients to 7.0.11 or 6.6.16 and ensure plugins are updated to 7.0.11 or 6.6.15 to resolve the path traversal flaw.