Zoom patches a zero-click flaw that could let a meeting participant execute code on another user’s computer through the annotation feature.
Zoom has patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413, in its annotation feature. CVE-2026-53413 is a memory corruption issue found by A Security that could allow a meeting participant to execute code on another participant’s computer.
Due to its impact, the researchers dubbed the flaw “Zoomsday,” it affects Zoom clients on all supported platforms and is linked to the proprietary protocol used by the annotation function. Zoom has now begun rolling out security updates to address the issue.
“Ⓐ Security, the Autonomous Offensive Security and Remediation Platform, discovered a critical flaw in Zoom that let an attacker take complete control of another user’s device during a live call. No click, no download, and nothing required of the victim but being in the meeting.” reads the report published by A Security. “The vulnerability is present in every version of Zoom on every device and operating system: Windows, Mac, iPhone, Android and Linux. The vulnerability exists in all versions up to and including 7.0.5.”
The flaw can corrupt memory through a specially crafted message. Attackers could exploit it to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.
“A Research was able to exploit the fact that every Zoom client automatically parses whatever it receives, sending a specially crafted message to corrupt the receiving client’s memory and run code on it.” continues the advisory. “The protocol opens a direct channel between a viewer and a sharer, letting the attacker target each participant individually.”
Attackers could join or host a Zoom meeting and silently take control of participants’ devices without any user interaction. Once compromised, they could steal data, activate microphones or cameras, or install malware. In large meetings, a single malicious message could expose multiple participants at once.
Zoom’s Android client was chosen as a target because it is closed-source, widely deployed, and exposes a large native-code attack surface. Researchers first ranked 3,762 functions across 70 libraries, but found the JNI-focused approach missed remotely reachable code. Dynamic tracing instead identified libannotate.so and its proprietary annotation protocol.
Reverse engineering showed that annotation objects are serialized and rebuilt from attacker-controlled network data without adequate origin checks. Researchers discovered CVE-2026-53413, a remotely triggerable stack buffer overflow in CAnnoFormatBlock::Deserialize. A wire-controlled count can exceed fixed 128-byte buffers, allowing data to overwrite adjacent memory. The flaw can be reached through Zoom’s normal encrypted transport, requiring no victim interaction or instrumentation.
A Security also found CVE-2026-53414, a missing bounds check in Zoom’s annotator that can cause a buffer overread and crash a meeting participant’s client, enabling DoS attacks. It also identified CVE-2026-53415, a use-after-free flaw, but Zoom had already discovered the issue before A Security reported it.
“Because a zero-click RCE requires no user interaction, we prioritized giving customers time to receive both the client patch and the server-side mitigation before publishing.” concludes the report. “This post follows that coordinated timeline, and we are releasing it alongside CVE assignment,” A Security notes.
This week, Zoom released Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms to address the above vulnerabilities.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Zoomsday)
