Zoom has shipped patches for four newly disclosed vulnerabilities in its meeting software, including one severe enough that a malicious participant could remotely run code on another attendee’s computer without them clicking anything, downloading anything, or seeing any warning sign at all.

Inside ‘Zoomsday’

The most serious of the four, tracked as CVE-2026-53413 and nicknamed “Zoomsday” by the researchers at A Security who found it, carries a high severity rating from Zoom’s own security team. The bug lives in Zoom’s annotation feature — the tool that lets participants draw, highlight, or add text on top of a shared screen. That feature works over a proprietary protocol that opens a direct data channel between whoever is presenting and whoever is watching.

According to the researchers, the routine that parses incoming annotation data relies on fixed-size 128-byte buffers but blindly trusts 32-bit size values sent from the other side of the connection, without checking whether the data actually fits. That gap lets an attacker send a deliberately oversized message that overflows the buffer, corrupts nearby memory, and ultimately hijacks the program’s execution flow. A Security demonstrated the exploit on macOS by using it to silently open Safari on a target’s machine — proof that an attacker only needs to join or host a meeting and aim the exploit at a specific participant, with no interaction required on the victim’s end.

Three More Bugs in the Same Bulletin Cycle

Zoom disclosed three additional issues alongside the headline flaw. CVE-2026-53414 is a medium-severity buffer over-read in Zoom’s clients that can leak the contents of memory it shouldn’t have access to. CVE-2026-53415 is a use-after-free vulnerability rated high severity, which can also lead to memory corruption and code execution if an attacker manages to trigger access to memory that has already been freed. CVE-2026-53416 is a separate, high-severity path traversal bug specific to Zoom’s Virtual Desktop Infrastructure (VDI) Client, which could let an attacker manipulate file paths to reach files outside their intended directory.

Zoom is tracking the four issues under bulletins ZSB-26015 through ZSB-26018, all published and updated on August 11. The three annotation- and memory-related bugs affect Zoom clients across every supported platform, while the path traversal flaw is limited to VDI deployments.

Fixes Are Already Available

Zoom has released updated versions that resolve all four issues: Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5 fix the annotation-related bugs, while Workplace VDI Client 7.0.11 and 6.6.16, along with VDI Plugin 7.0.11 and 6.6.15, address the path traversal flaw. Zoom says it has no evidence that any of the four vulnerabilities have been exploited in the wild, and no public proof-of-concept code is currently circulating.

Why It’s Still Urgent

Zero-click vulnerabilities are prized by attackers precisely because they remove the one variable defenders usually rely on — user judgment. A phishing-resistant employee who never clicks suspicious links or opens unexpected attachments offers no protection here, since exploitation only requires being in the same meeting as an attacker. For an application as widely deployed in corporate, government, and educational settings as Zoom, that combination of low attacker effort and broad reach makes rapid patch adoption especially important.

Recommended Actions

• Update all Zoom clients — desktop, mobile, and Rooms systems — to the patched versions listed in Zoom’s ZSB-26015 through ZSB-26018 bulletins as soon as possible.
• VDI deployments should prioritize the Workplace VDI Client and VDI Plugin updates separately, since the path traversal fix is not bundled with the standard client update.
• Enterprises managing Zoom centrally should push the update through managed deployment tools rather than relying on individual users to update manually.
• Security teams should treat any unexpected application launches or process activity during or immediately after video calls as worth investigating, given the demonstrated ability to trigger silent code execution.

Zoom’s swift patch turnaround and lack of observed in-the-wild exploitation offer some reassurance, but the underlying design lesson — that even a real-time annotation feature can become a memory-corruption vector — is one that other collaboration platforms with similar screen-sharing overlays should take seriously.