InfoSecBulletin Cybersecurity for mankind
A serious security flaw in Zoom might let a hacker take control of someone else’s device in a live meeting without the victim needing to click a link, download anything, or do anything else.
The weakness, dubbed “Zoomsday,” was found by a cybersecurity company called A Security using open AI models. Scientists said they spotted the flaw and created a working fix in under 24 hours with fewer than 20 AI prompts.
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
Hacker Actively Exploit SonicWall and SharePoint Flaws
Gunra Ransomware Leverage Fortinet VPN Flaws to Evade MFA Obtaining Enterprise Data
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Around 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
Google Chrome 151 Update Fixes 41 Flaws, 6 Critical
Swiss gov.t SharePoint incident compromised 200 accounts
Azad president, Secretary Post Heads to Contest: ISACA Dhaka Chapter Election
The vulnerability affected Zoom’s annotation functionality and could be exploited simply by having an attacker and victim in the same meeting. A Security said the issue affected Zoom clients across Windows, macOS, Linux, iOS and Android.
Zero-Click Attack Through Zoom Annotation
The vulnerability resides in Zoom’s proprietary annotation protocol. The feature allows participants to draw, add text, shapes and other objects while sharing a screen or using a digital whiteboard.
According to the researchers, Zoom clients automatically handle annotation messages from other users. A specially made message could cause memory issues in the receiving client and let harmful code run.
The victim didn’t have to engage with the harmful content. An attacker could join or run a meeting and aim at other attendees from afar, with no clear sign that an attack was happening.
An attacker can run code on a device. This can let them steal data, install harmful software, or get to private information. Researchers also showed they can run apps on a victim’s device.
The attack could work in both directions: a compromised presenter could target participants, while a malicious participant could target the presenter.
Three CVEs Assigned
The vulnerabilities discovered during the research are tracked as:
CVE-2026-53413: memory-corruption vulnerability allowing remote code execution.
CVE-2026-53414: an out-of-bounds memory-read vulnerability that can potentially expose sensitive memory contents.
CVE-2026-53415: a separate memory-corruption issue that can provide another potential path to remote code execution.
A Security rated the vulnerabilities with a CVSS 4.0 score of 9.0, calling them critical.
Zoom Released Security Fixes
A Security reported Zoom about the flaw on June 10, 2026, after finding a working zero-click exploit on June 9. Zoom accepted the report and later added protections on both the client and server sides.
Affected products included:
Zoom Workplace
Zoom Workplace VDI Client
Zoom Rooms
Zoom Meeting SDK
For Zoom Workplace, users need to update to version 7.1.5 or newer, or 7.0.6 or newer for the right branch. VDI Client users should update to 7.0.11 or 6.6.16. Zoom Rooms and Meeting SDK users need to update to 7.1.0 or newer.
Organizations need to quickly check Zoom versions on all company devices and update the systems used for important meetings first.
Security teams should think about limiting meeting access with waiting rooms, passcodes, and user verification. They can also turn off extra Zoom features like annotation, file transfer, whiteboarding, remote control, and third-party apps to lower the risk.
