InfoSecBulletin Cybersecurity for mankind
A serious security flaw in Zoom might let a hacker take control of someone else’s device in a live meeting without the victim needing to click a link, download anything, or do anything else.
The weakness, dubbed “Zoomsday,” was found by a cybersecurity company called A Security using open AI models. Scientists said they spotted the flaw and created a working fix in under 24 hours with fewer than 20 AI prompts.
CISA alerts on multiple PaperCut NG/MF flaws being actively exploited
Fire Ant hackers convert Cisco routers into spy platforms
Five Critical WordPress Flaws Lead to Site Takeover or RCE
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 AirportsÂ
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
The vulnerability affected Zoom’s annotation functionality and could be exploited simply by having an attacker and victim in the same meeting. A Security said the issue affected Zoom clients across Windows, macOS, Linux, iOS and Android.
Zero-Click Attack Through Zoom Annotation
The vulnerability resides in Zoom’s proprietary annotation protocol. The feature allows participants to draw, add text, shapes and other objects while sharing a screen or using a digital whiteboard.
According to the researchers, Zoom clients automatically handle annotation messages from other users. A specially made message could cause memory issues in the receiving client and let harmful code run.
The victim didn’t have to engage with the harmful content. An attacker could join or run a meeting and aim at other attendees from afar, with no clear sign that an attack was happening.
An attacker can run code on a device. This can let them steal data, install harmful software, or get to private information. Researchers also showed they can run apps on a victim’s device.
The attack could work in both directions: a compromised presenter could target participants, while a malicious participant could target the presenter.
Three CVEs Assigned
The vulnerabilities discovered during the research are tracked as:
CVE-2026-53413: memory-corruption vulnerability allowing remote code execution.
CVE-2026-53414: an out-of-bounds memory-read vulnerability that can potentially expose sensitive memory contents.
CVE-2026-53415: a separate memory-corruption issue that can provide another potential path to remote code execution.
A Security rated the vulnerabilities with a CVSS 4.0 score of 9.0, calling them critical.
Zoom Released Security Fixes
A Security reported Zoom about the flaw on June 10, 2026, after finding a working zero-click exploit on June 9. Zoom accepted the report and later added protections on both the client and server sides.
Affected products included:
Zoom Workplace
Zoom Workplace VDI Client
Zoom Rooms
Zoom Meeting SDK
For Zoom Workplace, users need to update to version 7.1.5 or newer, or 7.0.6 or newer for the right branch. VDI Client users should update to 7.0.11 or 6.6.16. Zoom Rooms and Meeting SDK users need to update to 7.1.0 or newer.
Organizations need to quickly check Zoom versions on all company devices and update the systems used for important meetings first.
Security teams should think about limiting meeting access with waiting rooms, passcodes, and user verification. They can also turn off extra Zoom features like annotation, file transfer, whiteboarding, remote control, and third-party apps to lower the risk.
