FHN 
Zoom has released security updates for four newly discovered vulnerabilities that could allow an attacker to execute code on another meeting participant’s computer remotely. The most serious issue requires no clicks, downloads, or other interaction from the victim, exposing serious Zoom vulnerabilities.
The most critical vulnerability, tracked as CVE-2026-53413, has been named “Zoomsday” by A Security, the research team that discovered the flaw. Zoom has rated the vulnerability as high severity.
The problem is linked to Zoom’s annotation feature, which allows participants to draw, highlight, and add text while someone is sharing their screen. Behind the scenes, this feature uses a proprietary communication protocol to exchange data between participants.
Researchers found that Zoom’s annotation component does not properly validate certain formatting information received over the network. Specifically, the function responsible for processing annotation data uses fixed-size memory buffers while trusting size values provided by the sender.
An attacker could take advantage of this weakness by sending specially crafted data that is larger than the allocated memory space. This can cause a buffer overflow, potentially allowing the attacker to corrupt memory and take control of the application.
A Security demonstrated the issue on macOS by using the vulnerability to launch Safari on a targeted computer without the user taking any action. The demonstration showed that successful exploitation could occur quietly, without obvious signs that the device had been compromised.
The attacker only needs to join or host a Zoom meeting and target another participant.
Three More Zoom Vulnerabilities
Zoom also disclosed three additional security issues as part of the same security update cycle.
CVE-2026-53414 is a medium-severity buffer over-read vulnerability affecting Zoom Clients. Successful exploitation could allow an attacker to access information from areas of memory that should not be exposed.
CVE-2026-53415 is a high-severity use-after-free vulnerability. It can cause memory corruption and could potentially lead to code execution when an attacker causes the application to access memory that has already been released.
CVE-2026-53416 affects the Zoom VDI Client and is caused by a path traversal vulnerability. An attacker could manipulate file paths to access files outside the directories intended by the application.
Zoom published these issues under security bulletins ZSB-26015 through ZSB-26018, with the bulletins published and updated on August 11, 2026.
Zoom Releases Security Fixes
Zoom says the annotation-related vulnerabilities affect its clients across supported platforms, while the path traversal issue is limited to VDI environments.
The company has already released fixes. The affected products should be updated to the following versions:
- Zoom Workplace: 7.1.5 or 7.0.6
- Zoom Rooms: 7.1.5
- Meeting SDK: 7.1.5
- Workplace VDI Client: 7.0.11 or 6.6.16
- VDI Plugin: 7.0.11 or 6.6.15
What Organizations Should Do
Zoom has not reported any confirmed exploitation of these vulnerabilities in the wild, and there is currently no publicly available proof-of-concept exploit.
However, the zero-click nature of CVE-2026-53413 makes the issue particularly important. Successful exploitation does not require the victim to open a file, click a link, or approve a prompt.
Organizations should prioritize updating Zoom across managed devices as soon as possible. IT and security teams should also consider deploying the updated packages centrally rather than depending entirely on users to update their applications themselves.
Keeping centralized installations updated can help prevent vulnerable versions from being reintroduced during future software deployments.
About the Author
