InfoSecBulletin Cybersecurity for mankind
A serious security flaw in Zoom might let a hacker take control of someone else’s device in a live meeting without the victim needing to click a link, download anything, or do anything else.
The weakness, dubbed “Zoomsday,” was found by a cybersecurity company called A Security using open AI models. Scientists said they spotted the flaw and created a working fix in under 24 hours with fewer than 20 AI prompts.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
The vulnerability affected Zoom’s annotation functionality and could be exploited simply by having an attacker and victim in the same meeting. A Security said the issue affected Zoom clients across Windows, macOS, Linux, iOS and Android.
Zero-Click Attack Through Zoom Annotation
The vulnerability resides in Zoom’s proprietary annotation protocol. The feature allows participants to draw, add text, shapes and other objects while sharing a screen or using a digital whiteboard.
According to the researchers, Zoom clients automatically handle annotation messages from other users. A specially made message could cause memory issues in the receiving client and let harmful code run.
The victim didn’t have to engage with the harmful content. An attacker could join or run a meeting and aim at other attendees from afar, with no clear sign that an attack was happening.
An attacker can run code on a device. This can let them steal data, install harmful software, or get to private information. Researchers also showed they can run apps on a victim’s device.
The attack could work in both directions: a compromised presenter could target participants, while a malicious participant could target the presenter.
Three CVEs Assigned
The vulnerabilities discovered during the research are tracked as:
CVE-2026-53413: memory-corruption vulnerability allowing remote code execution.
CVE-2026-53414: an out-of-bounds memory-read vulnerability that can potentially expose sensitive memory contents.
CVE-2026-53415: a separate memory-corruption issue that can provide another potential path to remote code execution.
A Security rated the vulnerabilities with a CVSS 4.0 score of 9.0, calling them critical.
Zoom Released Security Fixes
A Security reported Zoom about the flaw on June 10, 2026, after finding a working zero-click exploit on June 9. Zoom accepted the report and later added protections on both the client and server sides.
Affected products included:
Zoom Workplace
Zoom Workplace VDI Client
Zoom Rooms
Zoom Meeting SDK
For Zoom Workplace, users need to update to version 7.1.5 or newer, or 7.0.6 or newer for the right branch. VDI Client users should update to 7.0.11 or 6.6.16. Zoom Rooms and Meeting SDK users need to update to 7.1.0 or newer.
Organizations need to quickly check Zoom versions on all company devices and update the systems used for important meetings first.
Security teams should think about limiting meeting access with waiting rooms, passcodes, and user verification. They can also turn off extra Zoom features like annotation, file transfer, whiteboarding, remote control, and third-party apps to lower the risk.
