Vulnerabilities

Zoom Patches Zero-Click Annotation Flaw That Let Any Attendee Hijack Another's Computer

Zoom has patched ZOOMSDAY, a zero-click flaw in its annotation tool that let any meeting participant run code on another attendee's device — presenter to viewer and back. Researchers built a working exploit with a public AI tool in fewer than 20 prompts.

Nicholas Robert

Nicholas Robert

— 5 min read
Share
Flat white line-art of a shared screen with an annotation pen linking two laptops on a deep navy background, with one flat red dot.

Zoom has patched a zero-click flaw in its annotation tool — the draw-and-type layer people use on a shared screen — that let any participant in a meeting take over another attendee's computer. No click. No download. No on-screen prompt. Being in the meeting was the only precondition, and the takeover ran in both directions: whoever was sharing could reach everyone watching, and anyone watching could reach the presenter.

The detail that turns this from a routine client patch into a story is how it was found. The researchers behind it, A Security, say they built a working exploit in under a day using fewer than 20 prompts with publicly available AI models. A cross-participant, zero-click hijack of one of the world's most-used meeting clients was reduced to an afternoon's work with a public AI tool. That is the part worth sitting with.

What Zoom Actually Patched

Zoom's fixes cover a chain of memory-corruption issues in the annotation feature, which A Security nicknamed ZOOMSDAY. The lead vulnerability, CVE-2026-53413, is a memory-corruption bug that, per The Hacker News, could let a meeting participant execute code on another participant's machine. It was paired with CVE-2026-53414 — a memory over-read useful for defeating on-device memory protections — and CVE-2026-53415, a separate flaw in how the client handles annotation shape data, according to SecurityWeek and eSecurity Planet.

The common thread is that every Zoom client automatically parses the annotation data it receives during a meeting. A specially crafted message could corrupt the receiving client's memory and, chained together, run attacker-controlled code — enough, A Security says, to steal data or reach a device's camera and microphone. I'm keeping the mechanics deliberately high level: this is a defender's account, not a walkthrough. The point is the trust boundary that failed — a client acting on data it received automatically — not the specific bytes that made it fail.

A Security reports it confirmed the zero-click code execution against the Zoom client on Windows, macOS, iOS, and Android, so this was not a single-platform quirk. Zoom shipped client fixes and added a server-side mitigation to filter malicious messages before they reach vulnerable clients. That server-side filter has one important gap: it can't apply to end-to-end encrypted meetings, where Zoom's servers can't inspect the content. For E2EE calls, the updated client is the only real protection.

● Defender Scope: One Feature, Both Directions
A conceptual view, with no reproducible detail. The failure lives in one collaboration feature and reaches every client in the room.
1. The Surface: The Annotation Tool
The draw-and-type layer on a shared screen. Every client automatically parses the annotation data it receives during a meeting.
↓
2. The Reach: Cross-Participant, Both Ways
A presenter could reach the people watching, and a viewer could reach the presenter. The only precondition is presence in the meeting — no click, no download, no prompt.
↓
● 3. Why It Lands Differently
Zero-click, cross-participant, and multi-platform — and found with a public AI tool in fewer than 20 prompts. The barrier to building this class of exploit dropped to an afternoon.

Why the Discovery Method Is the Story

Zoom bugs get patched all the time. What makes ZOOMSDAY notable is the economics behind it. A Security says its team went from research to a working zero-click exploit in less than 24 hours, using fewer than 20 prompts against publicly available AI models — the kind of tooling anyone can sign up for. In the firm's own words: "The barrier to producing this class of weapon has collapsed, and it won't come back."

That framing matters because it changes the timeline defenders have to plan around. The assumption that a memory-corruption exploit in a hardened, widely audited client takes a well-funded team weeks or months no longer holds by default. This is the same pattern The CyberSignal has been tracking on the defensive side of the ledger — from zero-click hijacks jumping across AI browsers to a broader run of AI systems being turned on the software they touch. When the cost of finding and weaponizing a bug drops, the window between "patch released" and "exploit circulating" narrows with it.

What Is Confirmed, and What Isn't

Confirmed by the reporting and A Security's disclosure: the vendor is Zoom; the class is a zero-click, cross-participant hijack; the affected feature is the annotation tool; the only precondition is presence in the meeting; the reach is bidirectional, presenter to viewers and viewer to presenter; the lead CVE is CVE-2026-53413, part of a three-bug chain with CVE-2026-53414 and CVE-2026-53415; and the discovery used publicly available AI models in fewer than 20 prompts, in under a day, across Windows, macOS, iOS, and Android.

Still open, and I won't paper over it. A Security describes "publicly available AI models" rather than naming a single specific public AI tool, so treat the exact product as unspecified. Reported fixed-version thresholds vary slightly between outlets (fixes land in the Zoom Workplace 7.1.5 and 7.0.6 release branches), so confirm the exact build for your platform against Zoom's advisory rather than a news summary. I have not seen confirmation of any difference between free and enterprise tiers, any named victims, or any in-the-wild exploitation before the fix. And the specific exploit steps are not reproduced here, by choice.

What Defenders Should Do Now

The fix is a client update, so the work is mostly about making sure it actually reaches every endpoint.

Update Zoom clients now, and verify auto-update is on across the fleet. The patched builds sit in the current Zoom Workplace releases; the risk is not the update itself but the machines that quietly never take it. Confirm auto-update is enabled and pull a report on client versions rather than assuming.

Treat the annotation feature as an attack surface in high-value meetings. Where it isn't essential, consider disabling annotation — and limiting screen-share and annotation to trusted, named participants — for board calls, incident bridges, and anything sensitive until you've confirmed every attendee is patched.

Remember that end-to-end encrypted meetings don't get the server-side safety net. Zoom's server-side mitigation can't inspect E2EE content, so for those calls the client update is the whole defense. Prioritize patching for teams that run E2EE meetings.

Reinforce with meeting hygiene. Waiting rooms, restricting meetings to authenticated participants, and endpoint detection on the machines that run Zoom all shrink the blast radius if a participant client is ever compromised.

My read: the annotation bug will be patched and forgotten within a news cycle, but the discovery story shouldn't be. A small team turning a public AI tool into a zero-click, cross-participant exploit against a client this widely deployed — in under a day, in fewer than 20 prompts — is the signal here, and it lines up with the month's wider run of AI being pointed at the software it was meant to help with, which we tracked in our August 8 security roundup. The practical response is boring and correct: shorten your patch window, because everyone else's exploit window just got shorter too.

Primary Documents

Read more