Security researchers have detailed a critical vulnerability chain that previously allowed attackers to take complete control of a user’s device during a live videoconference without requiring any user interaction, clicks, or downloads. Discovered by Israeli cybersecurity firm Bankinfosecurity, the flaws were dubbed the “Zoomsday” vulnerability chain and affected Zoom’s native clients across major operating systems including Windows, macOS, iOS, and Android.
Zoom Flaws Enable Zero-Click Remote Code Execution via Annotation Function
According to SecurityWeek, the vulnerabilities resided within the annotator function built into the Zoom client, which utilizes a proprietary protocol to let meeting participants draw, highlight, or add information to shared content. Because every Zoom client automatically parsed whatever it received, an attacker could join or host a meeting, target any participant individually, and send a specially crafted message that corrupted the receiving client’s memory.
The Vulnerability Chain Breakdown
The Zoomsday exploit chain involved multiple security defects tied to the annotator functionality:
- CVE-2026-53413: A severe memory corruption issue that allowed a meeting participant to execute code on another participant’s machine.
- CVE-2026-53414: A missing bound check and memory over-read vulnerability in how text character data was processed through the annotation protocol. Attackers could exploit this to trigger a denial-of-service attack or leak memory addresses to help bypass address space layout randomization (TechRepublic).
- CVE-2026-53415: A use-after-free flaw in the annotator function. Researchers learned after reporting it that Zoom had already independently discovered this bug.
The attack triggered no visual cue indicating that a system had been compromised. Once malicious code ran on a victim’s device, threat actors could quietly steal personal data, install additional malware, or activate the camera and microphone to spy on the target.
Artificial Intelligence Accelerated Exploit Development
The discovery underscored the growing role of artificial intelligence in offensive security research. Researchers at A Security reported that they developed a working exploit in less than 24 hours by using fewer than 20 prompts with publicly available AI models. The firm stated that the barrier to producing this class of weapon has collapsed.
A Security disclosed that they coordinated their timeline with Zoom, prioritizing giving customers time to receive client patches and server-side mitigations before publishing details alongside CVE assignments.
Patches and Defensive Mitigations
Zoom released updates addressing the security issues. According to SecurityWeek, fixes are contained in Zoom Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms. Additionally, Zoom rolled out Workplace VDI Client for Windows versions 7.0.11 and 6.6.16, alongside Workplace VDI Plugins versions 7.0.11 and 6.6.15, which also patched CVE-2026-53416, a path traversal flaw leading to information disclosure.
Security experts emphasize that endpoint security software cannot reliably spot and block these zero-click attacks. Douglas McKee, director of vulnerability intelligence at Rapid7, advised organizations to enforce minimum client versions rather than relying on users to update themselves. Because attackers only needed meeting access to execute the exploit, administrative controls—such as waiting rooms, authenticated-user requirements, passcodes, and restricting unused features like annotation—help reduce the attack surface.
