Zoom has announced the release of patches to address four significant vulnerabilities, including a severe zero-click remote code execution flaw in its products. These vulnerabilities affect Zoom clients across all supported platforms, particularly within the annotator function that utilizes a proprietary protocol. The most critical vulnerability, identified as CVE-2026-53413, involves a memory corruption issue allowing a meeting participant to execute code on another participant's device without any user interaction. This vulnerability, dubbed Zoomsday by A Security, was exploited by sending specially crafted messages that corrupt the receiving client's memory.
The annotator's proprietary protocol opens a direct communication channel between a viewer and a sharer, enabling attackers to target individual meeting participants. A missing bound check within the text annotator facilitated this by letting attackers write code beyond the intended buffer. Another vulnerability, CVE-2026-53414, involved a similar missing bound check, resulting in a buffer overread that could trigger denial-of-service attacks. Additionally, a use-after-free flaw, CVE-2026-53415, was found in the annotator function. Although A Security discovered it, Zoom was already aware of this issue.
In response, Zoom rolled out updates for multiple versions of its products. These include Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5, which all include fixes for the mentioned vulnerabilities. Furthermore, patches for CVE-2026-53416, a path traversal flaw leading to information disclosure, have been included in the Workplace VDI Client for Windows versions 7.0.11 and 6.6.16, and Workplace VDI Plugins versions 7.0.11 and 6.6.15. More information on these resolved vulnerabilities can be found on Zoom's security bulletins page.