Zoom patched four flaws in its annotation feature on 11 August 2026. Researchers at A Security, who named the set Zoomsday, describe the most serious as zero-click: no required action from the victim and no visual cue indicating the compromise.
The four
| CVE | Type | Impact |
|---|---|---|
| CVE-2026-53413 | Missing bound check in the text annotator | Memory corruption → remote code execution |
| CVE-2026-53414 | Missing bound check in the annotator | Buffer overread → denial of service |
| CVE-2026-53415 | Use-after-free in an annotator function | Zoom had already found this one independently |
| CVE-2026-53416 | Path traversal | Information disclosure; affects VDI clients and plugins |
The first writes past a buffer boundary. The others are the supporting cast.
Why annotation is the attack surface
Annotation — drawing on someone else's shared screen — uses a proprietary protocol that opens a direct channel between viewers and the sharer.
That is the whole story. Most of a video call is media, handled by hardened codecs and relayed through Zoom's infrastructure. Annotation is a separate, less-examined path that carries structured data from one participant straight into another participant's client, and it parses it.
An attacker can join or host a meeting and target an individual participant. Code executes without interaction.
What "zero-click" means in practice here
The attacker has to be in the meeting. That is the precondition and it is not a small one — for an internal standup it is close to impossible.
For everything else, it is a formality. Sales calls, customer support sessions, candidate interviews, webinars, vendor demos, external project meetings: every one of those is a meeting with someone you do not control, and most organisations run dozens a day.
Combine that with the fake-recruiter campaigns running right now — where the entire pretext is getting a technical person onto a video call — and the precondition stops being a barrier and becomes a step.
Patch, precisely
| Product | Fixed version |
|---|---|
| Zoom Workplace | 7.1.5 and 7.0.6 |
| Zoom Rooms | 7.1.5 |
| Meeting SDK | 7.1.5 |
| VDI Client for Windows | 7.0.11 and 6.6.16 |
| VDI Plugins | 7.0.11 and 6.6.15 |
All supported platforms are covered.
The two Zoom Workplace versions exist because organisations pin to different tracks; check which one your fleet is on rather than assuming the higher number applies.
A Security's disclosure was coordinated, and they say the timing prioritised giving customers time to receive both the client patch and the server-side mitigation before publication. That is worth noting: part of the fix is on Zoom's side and arrived without anyone doing anything, which is why this is being published now rather than being sat on.
What to do
- Push the client update. Zoom auto-updates by default; managed fleets frequently disable that, and those are the ones that will still be vulnerable next month.
- Check your VDI plugin versions separately. They are on their own version line and are routinely forgotten.
- Consider whether annotation needs to be on for external meetings. It is an account-level setting and most organisations never use it with people outside the company.
- Treat "who is in this meeting" as an access control question. For an external call, the participant list is your attack surface.
