InfoSecBulletin Cybersecurity for mankind
A serious security flaw in Zoom might let a hacker take control of someone else’s device in a live meeting without the victim needing to click a link, download anything, or do anything else.
The weakness, dubbed “Zoomsday,” was found by a cybersecurity company called A Security using open AI models. Scientists said they spotted the flaw and created a working fix in under 24 hours with fewer than 20 AI prompts.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
The vulnerability affected Zoom’s annotation functionality and could be exploited simply by having an attacker and victim in the same meeting. A Security said the issue affected Zoom clients across Windows, macOS, Linux, iOS and Android.
Zero-Click Attack Through Zoom Annotation
The vulnerability resides in Zoom’s proprietary annotation protocol. The feature allows participants to draw, add text, shapes and other objects while sharing a screen or using a digital whiteboard.
According to the researchers, Zoom clients automatically handle annotation messages from other users. A specially made message could cause memory issues in the receiving client and let harmful code run.
The victim didn’t have to engage with the harmful content. An attacker could join or run a meeting and aim at other attendees from afar, with no clear sign that an attack was happening.
An attacker can run code on a device. This can let them steal data, install harmful software, or get to private information. Researchers also showed they can run apps on a victim’s device.
The attack could work in both directions: a compromised presenter could target participants, while a malicious participant could target the presenter.
Three CVEs Assigned
The vulnerabilities discovered during the research are tracked as:
CVE-2026-53413: memory-corruption vulnerability allowing remote code execution.
CVE-2026-53414: an out-of-bounds memory-read vulnerability that can potentially expose sensitive memory contents.
CVE-2026-53415: a separate memory-corruption issue that can provide another potential path to remote code execution.
A Security rated the vulnerabilities with a CVSS 4.0 score of 9.0, calling them critical.
Zoom Released Security Fixes
A Security reported Zoom about the flaw on June 10, 2026, after finding a working zero-click exploit on June 9. Zoom accepted the report and later added protections on both the client and server sides.
Affected products included:
Zoom Workplace
Zoom Workplace VDI Client
Zoom Rooms
Zoom Meeting SDK
For Zoom Workplace, users need to update to version 7.1.5 or newer, or 7.0.6 or newer for the right branch. VDI Client users should update to 7.0.11 or 6.6.16. Zoom Rooms and Meeting SDK users need to update to 7.1.0 or newer.
Organizations need to quickly check Zoom versions on all company devices and update the systems used for important meetings first.
Security teams should think about limiting meeting access with waiting rooms, passcodes, and user verification. They can also turn off extra Zoom features like annotation, file transfer, whiteboarding, remote control, and third-party apps to lower the risk.
