Zoom has corrected four vulnerabilities that could enable attacks against meeting participants, including flaws capable of achieving remote code execution without any clicks from the victim.
The issues were disclosed on 11 August 2026. The most critical vulnerability in the attack context, CVE-2026-53413, received a CVSS score of 8.3 and was dubbed Zoomsday. The flaw exists in the annotation feature used to draw, highlight, or insert text during screen sharing.
The component responsible for processing these annotations employs fixed 128-byte buffers but fails to correctly validate the size of data received over the network. A malicious participant can send oversized content that exceeds available space, resulting in memory corruption. This corruption can redirect the program's execution flow and permit commands controlled by the attacker.
Researchers demonstrated the attack on macOS by causing the Zoom process to silently open Safari on the victim's machine. The vulnerabilities impact versions of Zoom Workplace, Zoom Rooms, Meeting SDK, and VDI clients.
To address the annotation vulnerabilities, users should migrate to corrected releases such as Workplace 7.1.5 or 7.0.6 and Zoom Rooms and Meeting SDK 7.1.5. There are no public indications of active exploitation. Nevertheless, organizations should prioritize updates to centralized installations, especially since an attacker can exploit the flaws during a meeting without requiring downloads or additional victim interaction.
