Key Takeaways
- A zero‑click vulnerability in Zoom’s annotation feature allowed any meeting participant to execute arbitrary code on the computers of everyone else in the call, and vice‑versa, without any interaction from the victim.
- The flaw resided in how Zoom parsed drawing objects sent over the network: a missing bounds check on a fixed‑size buffer enabled buffer over‑write, over‑read, and use‑after‑free conditions.
- Patches were released in June – July 2026 (versions 7.1.5/7.0.6 for Zoom Workplace, 7.0.11/6.6.16 for the VDI client, and 7.1.0/7.1.5 for Zoom Rooms and Meeting SDK) but were not disclosed publicly until August 2026.
- The vulnerabilities are tracked as CVE‑2026‑53413 (CVSS 8.3), CVE‑2026‑53414 (CVSS 6.5) and CVE‑2026‑53415 (CVSS 8.3) by Zoom; the researching firm “A Security” rates all three at CVSS 4.0 9.0, highlighting a scoring disagreement.
- “A Security” claims it developed a working exploit in under a day using fewer than 20 prompts on publicly available AI models, a claim that cannot be independently verified because the specific models were not named.
- Zoom attributes the use‑after‑free flaw to its internal Offensive Security team and notes that user interaction is required, which conflicts with the zero‑click description given by the researchers.
- No exploitation has been reported in the wild, and none of the CVEs appear in CISA’s Known Exploited Vulnerabilities catalog as of the article’s publication.
Overview of the Vulnerability
The security issue was discovered in Zoom’s screen‑sharing annotation tool, which lets participants draw, type, or stamp on a shared screen. Researchers found that a malformed drawing object could be crafted to trigger memory‑corruption bugs in the receiving client. Because the annotation data is transmitted as a structured object— a run of length counts followed by the actual byte data— an attacker could manipulate the length field to cause the client to read or write past the boundaries of a fixed 128‑byte buffer. No user interaction, such as clicking a link or downloading a file, was required; merely being present in a meeting where the malicious annotation was sent was sufficient for exploitation.
Technical Details of the Buffer Over‑Write (CVE‑2026‑53413)
One of the three flaws is a classic buffer over‑write. The annotation parser allocates a 128‑byte buffer on the stack to hold the incoming drawing data. It then copies the payload into this buffer using the length value supplied by the sender without verifying that the length does not exceed 128 bytes. Because this buffer is the last field of the object, an oversized count overwrites the saved return address on the stack, allowing the attacker to redirect execution to attacker‑controlled shellcode when the function returns. Successful exploitation grants the attacker full control of the victim’s machine, enabling arbitrary code execution, data theft, or further lateral movement within the network.
Technical Details of the Buffer Over‑Read (CVE‑2026‑53414)
A second flaw is a buffer over‑read. Here, the parser again trusts the supplied length field but uses it to determine how many bytes to read from the incoming packet into a temporary buffer. If the length exceeds the actual amount of data present, the parser reads past the end of the supplied packet into adjacent heap memory. The researchers demonstrated that this could leak uninitialized heap contents, including live code pointers and virtual‑function table (vtable) addresses, which can be used to bypass address‑space layout randomization (ASLR). Zoom’s advisory, however, characterises the impact as merely a denial‑of‑service possibility and assigns a confidentiality impact of “none,” reflecting a differing risk assessment.
Technical Details of the Use‑After‑Free (CVE‑2026‑53415)
The third vulnerability is a use‑after‑free condition. During processing of a drawing object, Zoom temporarily allocates a heap structure to hold intermediate state. Under certain malformed inputs, the structure is freed early, but a later code path still attempts to use the dangling pointer. An attacker can manipulate the heap layout— for example, by spraying the heap with controlled objects— so that the freed memory is re‑allocated with attacker‑controlled data. When the dangling pointer is dereferenced, the attacker gains control of program flow, again leading to arbitrary code execution. Zoom credits its internal Offensive Security team for discovering this issue, whereas “A Security” lists it as one of its own findings.
Patch Information and Affected Versions
Zoom released client‑side patches in June and July 2026, roughly two months before the details were made public. The fixed versions are:
- Zoom Workplace (all supported platforms): before 7.1.5 and 7.0.6 in their respective release branches.
- Zoom Workplace VDI Client for Windows: before 7.0.11 and 6.6.16.
- Zoom Rooms and Zoom Meeting SDK (all platforms): before 7.1.0, with the third flaw addressed only in versions before 7.1.5.
No exploitation has been observed in the wild, and none of the three CVEs appear in CISA’s Known Exploited Vulnerabilities catalog as of the article’s date. The patches address the underlying memory‑corruption bugs by adding proper bounds checks on the length fields and ensuring that freed objects are not reused without validation.
Discrepancies in Severity Scoring and Attribution
While Zoom assigns CVSS scores of 8.3, 6.5, and 8.3 to the three vulnerabilities (using the legacy CVSS v3.1 framework), the researching firm “A Security” rates all three at 9.0 under the newer CVSS 4.0 model. The difference stems from differing assumptions about attack complexity, privileges required, and the impact of information disclosure. Zoom also marks user interaction as required for each flaw, which contradicts the zero‑click nature asserted by the researchers. Regarding attribution, two of the bulletins name Idan Levcovich of “A Security” as the discoverer, while the use‑after‑free advisory credits Zoom’s internal Offensive Security team. “A Security” acknowledges that Zoom was already aware of the third flaw and had mitigated it server‑side before the report arrived, yet still claims full ownership of the finding in its public post.
Exploit Development Using Public AI Models
According to “A Security,” the team moved from vulnerability identification to a working exploit in under a day by leveraging publicly available AI language models. They claim that fewer than 20 prompts were sufficient to generate the necessary code snippets and exploit logic. The post does not disclose which models were used, preventing independent verification of the claim. For context, OpenAI’s Daybreak program was split the day before the article’s release, and the restricted GPT‑5.6‑Cyber model was made available only to vetted partners, with the company asserting that such capabilities require gating. OpenAI’s internal metrics suggest that its guard‑railed public model answers roughly 1.5 % of advanced offensive‑security prompts, compared with 95 % for the restricted variant, underscoring the potential power of less‑restricted models if misused.
Implications and Defensive Recommendations
The Zoom annotation flaws illustrate how a seemingly innocuous collaboration feature can become a potent attack surface when memory‑safety checks are missing. Organizations should ensure they are running the patched versions listed above, disable or restrict the annotation feature for untrusted participants if immediate patching is not possible, and monitor for anomalous memory‑corruption indicators in endpoint detection and response (EDR) tools. Additionally, the episode raises broader concerns about the dual‑use nature of generative AI: while these models can accelerate defensive research, they also lower the barrier for offensive exploit development, prompting calls for clearer usage policies and possibly stricter distribution controls for high‑risk model variants. Until such safeguards are widely adopted, vigilance around zero‑click, memory‑corruption vulnerabilities in widely deployed collaboration software remains essential.