Zoom Zero-Click ‘Zoomsday’ Flaw Lets Meeting Participants Execute Code on Other Users’ Devices

Zoom has released security updates to address four vulnerabilities that could expose meeting participants to significant attacks, including a zero-click remote code execution flaw dubbed “Zoomsday.”

The most severe issue, tracked as CVE-2026-53413, affects Zoom’s annotation feature, which allows participants to draw, highlight, and add text during screen sharing sessions.

Researchers at A Security indicated that a malicious participant could exploit this flaw to execute code on another attendee’s device without the victim needing to click a link, download a file, approve a prompt, or take any visible action.

Zoom Zero-Click ‘Zoomsday’ Flaw

Zoom rates this vulnerability as high severity. The issue arises from the proprietary communication protocol used by the annotation feature to exchange data directly between the screen sharer and viewers.

Researchers identified a memory-safety problem in the CAnnoFormatBlock::Deserialize routine, which processes text-formatting information received via that protocol.

The affected function employs several fixed-size, 128-byte buffers but reportedly accepts 32-bit character-length values from remote participants without verifying that the declared data size fits within those buffers.

As a result, an attacker can send an oversized, specially crafted message in the annotation format, potentially leading to a buffer overflow. Successful exploitation might corrupt adjacent memory and alter the application’s control flow, enabling arbitrary code execution within the Zoom client process.

A security researcher demonstrated the attack against Zoom on macOS by silently launching Safari on a target system. This proof-of-concept showed that an attacker could compromise a selected meeting attendee merely by joining or hosting a meeting, without any warning or visible indication for the victim.

While the demonstration launched a benign application, the underlying capability could facilitate far more damaging outcomes if weaponized.

Zoom also addressed three additional issues disclosed in the same bulletin cycle:

• CVE-2026-53414 is a medium-severity buffer overflow vulnerability in Zoom Clients that may expose sensitive information stored in process memory.
• CVE-2026-53415 is a high-severity use-after-free flaw that can lead to memory corruption and may provide a pathway to code execution under certain conditions.
• CVE-2026-53416 is a high-severity path traversal vulnerability affecting Zoom’s Virtual Desktop Infrastructure (VDI) Client, which could allow unauthorized access to sensitive files by manipulating file paths outside intended directories.

These vulnerabilities are documented in Zoom security bulletins ZSB-26015 through ZSB-26018, published and updated on August 11, 2026. The annotation-related flaws impact Zoom clients across all supported platforms, while the path traversal vulnerability is limited to VDI environments.

To address the annotation vulnerabilities, users should update to Zoom Workplace version 7.1.5 or 7.0.6, Zoom Rooms version 7.1.5, and Meeting SDK version 7.1.5. VDI customers should update to Workplace VDI Client versions 7.0.11 or 6.6.16 and VDI Plugin versions 7.0.11 or 6.6.15.

Zoom has not reported any active exploitation or public proof-of-concept for these vulnerabilities. However, organizations should prioritize centralized deployment of these updates, as zero-click, meeting-based attacks can expose users before they realize they have been compromised.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world