Critical Zoom Zero-Click Flaws Let Attackers Hijack User Devices

Key Takeaways

• Zoom has released critical patches for four vulnerabilities, including a severe zero-click remote code execution (RCE) flaw.
• The primary RCE vulnerability, dubbed “Zoomsday,” resides within Zoom’s annotation feature and affects clients across all supported platforms.
• Attackers could exploit these flaws to hijack user devices, execute arbitrary code, or leak sensitive data without any user interaction.
• Fixes are available in Zoom Workplace versions 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, Meeting SDK 7.1.5, and specific VDI client/plugin versions.

Zoom has recently addressed a quartet of critical security vulnerabilities, including a particularly dangerous zero-click flaw that could allow a malicious actor to remotely seize control of a participant’s computer during a meeting. This exploit requires no user interaction, downloads, or visible warnings.

“Zoomsday” — A Critical Zero-Click RCE

The most significant of these vulnerabilities, tracked as CVE-2026-53413, has been named “Zoomsday” by A Security, the research team responsible for its discovery. Zoom’s own Trust and Security team has assigned this bug a “high” severity rating.

The core of this flaw lies within Zoom’s annotation feature, which enables users to draw, highlight, or add text while a screen is being shared. This functionality relies on a proprietary communication protocol that establishes a direct channel between the screen sharer and viewers.

Researchers uncovered that the CAnnoFormatBlock::Deserialize routine, responsible for parsing text-annotation formatting data, utilizes fixed-size 128-byte buffers. However, it uncritically accepts 32-bit character counts transmitted over the network.

Since the client fails to validate if incoming data fits within these buffers, an attacker can send an excessively large, specially crafted message. This action triggers a buffer overflow, corrupting adjacent memory and ultimately hijacking the program’s control flow to execute arbitrary code.

A Security researcher demonstrated this exploit on macOS, silently launching the Safari browser on a victim’s machine. This confirmed that full code execution is achievable without any user interaction and leaves no visible trace of compromise. An attacker merely needs to join or host a meeting and target any participant.

Additional Vulnerabilities Disclosed

In conjunction with CVE-2026-53413, Zoom detailed three other related security issues in the same bulletin cycle:

• CVE-2026-53414: Rated medium severity, this buffer over-read bug in Zoom Clients could lead to the leakage of memory contents.

• CVE-2026-53415: A high-severity use-after-free vulnerability, this flaw could result in memory corruption and potential code execution if an attacker manages to trigger access to freed memory.

• CVE-2026-53416: Affecting Zoom’s Virtual Desktop Infrastructure (VDI) Client, this high-severity path traversal weakness could expose sensitive files by allowing an attacker to manipulate file paths beyond their intended directories.

Zoom’s bulletins ZSB-26015 through ZSB-26018, all updated and published on August 11, 2026, cover these issues.

The annotation-related vulnerabilities impact Zoom clients across all supported platforms, while the path traversal issue is specific to VDI deployments. Zoom has stated there is no evidence of these vulnerabilities being actively exploited in the wild, and no public proof-of-concept exploits are currently circulating.

What You Should Do

• Update Immediately: Ensure all Zoom clients are updated to the latest secure versions. For annotation flaws, update to Zoom Workplace versions 7.1.5 or 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5.
• VDI Specific Updates: For VDI deployments, update Workplace VDI Client to versions 7.0.11 or 6.6.16, and VDI Plugin to versions 7.0.11 or 6.6.15 to patch the path traversal bug.
• Centralized Deployment Management: Organizations with centralized Zoom deployments should deploy updated installer packages promptly. Do not rely on individual users to manually update, as this can lead to vulnerable builds reappearing.
• Stay Vigilant: Despite no active exploitation reports, the zero-click nature of the primary flaw makes it an urgent patching priority for all users and security teams.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.