Researchers at A Security have identified multiple vulnerabilities in Zoom that allowed attackers to silently compromise the device of any meeting participant. No clicks, file downloads, or confirmations were required from the victim.
The issues affected the shared annotations protocol, which permits users to draw and leave notes on a shared screen during a call. Both regular participants and meeting organizers could be targeted. Attackers could invite an employee to a standard call, gain control of the computer and credentials, and then move laterally inside the corporate network.
Webinars and semi-public events increased the risk, as participants are less suspicious of unknown attendees than of suspicious email attachments. The vulnerabilities impacted Zoom clients on Windows, macOS, Linux, iOS, and Android.
The discovery method itself stands out: the team used publicly available AI models. Locating the flaws and creating a working exploit prototype required fewer than 20 prompts. Previously, a team of five specialists might have spent around six months on similar research.
Zoom released security bulletin ZSB-26015 and deployed fixes on both server and client sides. Users are advised to install the latest version of the application without delay.
