Zoomsday Exposed: How a Single Zoom Meeting Could Hand Attackers Full Control of Your Device
Picture this: you join a routine Zoom call, camera off, coffee in hand, half-listening while someone shares their screen. You don't click anything. You don't download a file. You don't approve a single prompt. And yet, by the time the meeting ends, an attacker sitting three seats away in the same call — or three continents away — has already run code on your machine, quietly, invisibly, without you ever knowing the meeting turned hostile.
That is not a hypothetical. It is exactly what security researchers at A Security demonstrated against Zoom's annotation feature, in a vulnerability chain they named Zoomsday. Zoom has since patched it, but the mechanics of this bug deserve a close look, because they reveal a pattern SOC teams are going to see more of: attacker-controlled parsing logic hiding inside "harmless" collaboration features.
Table of Contents
- What Actually Happened
- Inside the Flaw: Why Annotation Data Was the Perfect Attack Surface
- CVE Breakdown: All Four Vulnerabilities
- The Uncomfortable Part: An AI Agent Built This in Under a Day
- Real-World Impact for Enterprises
- Detection: What SOC Teams Should Watch For
- Patch Verification Commands
- Prevention & Hardening Checklist
- Expert Tips
- Related Articles
- FAQ
- Conclusion
What Actually Happened
On August 11, 2026, Zoom published four security bulletins — ZSB-26015 through ZSB-26018 — disclosing and patching a set of memory-corruption vulnerabilities across its desktop, mobile, and VDI clients. The headline bug, tracked as CVE-2026-53413 and nicknamed "Zoomsday" by the researchers who found it, allowed a malicious meeting participant to remotely execute code on another attendee's device with zero user interaction.
No phishing link. No malicious attachment. No "click to enable" prompt. The victim only had to be present in a Zoom meeting while an attacker targeted them individually through the platform's built-in annotation channel.
The research was carried out by A Security, whose vulnerability researcher Idan Levcovich first identified the issue on June 8, 2026, while analyzing Zoom's Android client. A working zero-click exploit against Zoom Client v7.0.5 was confirmed the very next day, and the bug was privately disclosed to Zoom on June 10 — well before today's public writeup.
Inside the Flaw: Why Annotation Data Was the Perfect Attack Surface
Zoom's annotation feature lets meeting participants draw, highlight, or type directly on top of a shared screen. Most people assume this works like an image overlay — a picture drawn on top of the video feed. It doesn't.
Under the hood, annotations are transmitted as structured data: a continuous stream of instructions telling the receiving client exactly how to draw each line, shape, or character on screen. This data travels over a completely proprietary, undocumented protocol that opens a direct channel between whoever is sharing their screen and whoever is viewing it — and critically, the receiving client automatically parses whatever it receives, with no manual trigger from the user.
That automatic parsing is where things fell apart. The routine responsible for handling annotation formatting data, CAnnoFormatBlock::Deserialize, allocates several fixed-size 128-byte buffers. But it blindly trusts a 32-bit character count sent over the network to decide how much data to copy into those buffers. There is no bounds check confirming the incoming data actually fits.
Send an oversized, specially crafted annotation message, and the parser happily copies more bytes than the buffer can hold — overflowing into adjacent memory. Chain that with a second bug that leaks memory contents (helpful for defeating ASLR) and a third use-after-free flaw, and researchers had everything needed to hijack control flow and execute arbitrary code on the target's machine.
A Security proved this wasn't theoretical by demonstrating the exploit on macOS: their proof-of-concept silently launched Safari on the victim's machine — with the attacker only needing to join or host a meeting and target any single participant, individually, with no visual cue that anything had happened.
CVE Breakdown: All Four Vulnerabilities
| CVE ID | Type | Severity | Impact |
|---|---|---|---|
| CVE-2026-53413 ("Zoomsday") | Buffer overwrite (stack-based) | High (8.3) | Zero-click remote code execution via annotation protocol |
| CVE-2026-53414 | Buffer over-read | Medium (6.5) | Memory content leak; can crash a participant's client and aid exploit reliability |
| CVE-2026-53415 | Use-after-free | High (8.3) | Memory corruption via unvalidated pointers in auto-shape metadata handling; potential RCE |
| CVE-2026-53416 | Path traversal | High | Affects Zoom VDI Client only; exposes sensitive files outside intended directories |
The first three vulnerabilities affect Zoom clients across all supported platforms — Windows, macOS, iOS, and Android. CVE-2026-53416 is scoped specifically to Zoom's Virtual Desktop Infrastructure deployments, which enterprises commonly use in call centers, healthcare environments, and regulated industries running Zoom inside a virtualized desktop.
The Uncomfortable Part: An AI Agent Built This in Under a Day
What makes Zoomsday genuinely newsworthy beyond the technical details is how fast it came together. According to A Security, the reverse-engineering and exploit-development work was assisted heavily by publicly available AI models — used to rank interesting native functions, reconstruct Zoom's proprietary annotation protocol, and flag unsafe memory operations.
Levcovich noted that producing a working exploit chain against a bug of this severity has traditionally required nation-state-level resources: elite teams, months of work, and significant budget. A Security says they did it in a single day, using fewer than 20 prompts against models anyone can access today.
For SOC teams and CISOs, that timeline compression is the real story. It signals that the gap between "vulnerability exists" and "weaponized exploit exists" is shrinking fast — and defenders need to assume disclosure-to-exploitation windows will keep getting shorter.
Real-World Impact for Enterprises
Video conferencing sits in a strange trust zone. Organizations lock down email attachments, sandbox downloads, and train employees to spot phishing — but a scheduled Zoom call with a known-looking participant list rarely triggers the same scrutiny. That's exactly the blind spot Zoomsday exploited.
Consider the realistic attack paths this opens up:
- External vendor or client calls — any meeting with an unverified or compromised external participant becomes a potential delivery vector.
- Large webinars and town halls — a single malicious attendee could individually target specific executives or IT staff in the same call.
- VDI-based call centers — CVE-2026-53416's path traversal issue is especially relevant here, where Zoom often runs inside shared virtual desktop images.
- Post-compromise persistence — once code execution is achieved, an attacker can pivot toward credential theft, lateral movement, or dropping a secondary payload, all without a single alert from email or web-based controls.
Zoom has stated it has found no evidence of active exploitation in the wild and no public proof-of-concept is currently circulating. That's good news for now — but "not yet exploited" is not the same as "not exploitable," and history shows attackers move fast once technical writeups like A Security's are public.
Detection: What SOC Teams Should Watch For
Because the exploit lives inside Zoom's proprietary protocol and leaves no visual trace inside the meeting, traditional network signatures are limited. Still, there are practical detection angles worth building into your monitoring:
- EDR process-lineage alerts — flag any unexpected child process spawned by
zoom.exe,zoom.us, or the Zoom Rooms binary. A legitimate annotation session should never spawn a browser, shell, or script interpreter as a child process. - Unusual outbound connections from Zoom processes — post-exploitation payloads often reach out to a C2 server shortly after code execution; correlate this with meeting join/leave timestamps.
- Version telemetry — inventory every endpoint still running Zoom Workplace builds older than 7.1.5 / 7.0.6, or VDI Client builds older than 7.0.11 / 6.6.16. These remain exposed.
- Crash and error log review — CVE-2026-53414 (buffer over-read) can cause a participant's client to crash. Unexplained Zoom crash reports clustered around specific meetings are worth investigating retroactively.
Patch Verification Commands
Before assuming your fleet is safe, verify the installed Zoom client version directly. Here's how to check on the most common platforms:
Windows (PowerShell):
Get-ItemProperty "HKLM:\SOFTWARE\Zoom\Zoom Meetings" -Name Version -ErrorAction SilentlyContinueThis pulls the installed Zoom client version from the registry. Run it across your endpoint fleet via your RMM or EDR query console to identify machines still on pre-7.1.5/7.0.6 builds.
macOS (Terminal):
mdls -name kMDItemVersion /Applications/zoom.us.appReturns the installed application version so you can cross-check it against the patched release numbers before clearing an endpoint.
Enterprise-wide rollout (recommended over manual updates):
zoominstallfull.exe /log "C:\zoom_update.log" /norestart /qnUse this with your software deployment tool (SCCM, Intune, Jamf, etc.) to silently push the patched Zoom installer package fleet-wide. Pushing centralized installer packages is strongly preferred over relying on individual users to update manually — vulnerable builds have a habit of silently reappearing after a fresh install or image re-deployment if the update isn't baked into the base image.
Disclaimer: Always test deployment commands in a controlled environment before pushing to production endpoints, and adjust package paths/flags to match your organization's software distribution tooling.
Detection & Prevention Checklist
- Patch immediately to Zoom Workplace 7.1.5 / 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5 across all endpoints.
- For VDI environments, update Workplace VDI Client to 7.0.11 / 6.6.16 and VDI Plugin to 7.0.11 / 6.6.15.
- Push updates centrally through MDM/RMM rather than relying on end-user prompts.
- Bake the patched version into your golden VDI images so re-provisioning doesn't reintroduce the vulnerable build.
- Restrict annotation permissions in sensitive meetings via Zoom's admin settings ("Disable annotation for others" / "Only host can annotate") as a compensating control until every endpoint is confirmed patched.
- Add Zoom client version checks to your vulnerability management scan cadence, not just OS-level patching.
- Educate staff that "zero-click" means normal meeting behavior offers no warning — vigilance has to shift to patch compliance, not user awareness training, for this class of bug.
Expert Tips
- Treat any collaboration software with a proprietary, auto-parsing network protocol (annotation tools, whiteboard sync, remote-control features) as a first-class attack surface in your threat model — not just email and browsers.
- If you run Zoom inside VDI for call centers or regulated environments, patch CVE-2026-53416 with priority; path traversal in a shared virtual desktop can expose far more than one user's session.
- Track A Security's and Zoom's bulletins directly (ZSB-26015 to ZSB-26018) rather than relying solely on secondary summaries — Zoom occasionally revises severity ratings and affected version ranges after initial publication.
- Build "AI-accelerated exploit development" into your risk conversations with leadership. Zoomsday is a live example of a nation-state-caliber exploit chain built in under 24 hours with off-the-shelf AI tools — patch SLAs need to reflect that reality.
Related Cybersecurity Topics You Should Explore
- SonicWall SMA1000 Flaws Now Fuel Ransomware Attacks – CISA Warns
- HP ThinPro's 'Encrypted' Drives Aren't Actually Safe — Here's Why
- GRR Rapid Response: The Free Google Tool That Hacks 100K PCs Remotely
- One Failed Login, Full Server Takeover: WordPress XSS2Shell
- I Traced a Webshell Using Just 6 Linux Commands — Here's How
- How a Fake Movie File Can Empty Your Bank Account in Seconds
- CaptiveCrunch: How Russian Hackers Turned Hotel Wi-Fi Into a Weapon
- CVE-2026-12935: The TP-Link Bug Every Router Owner Should Fix Now
- Adform Hack Turns Trusted Ad Script Into a Crypto Stealer
- The Security Story Hidden Inside Windows 11's Big Update
- SplitVPN Data Breach: 865K Users Exposed, 'No-Logs' Was a Lie
FAQ
Q1: Do I need to click anything for Zoomsday to affect me?
No. CVE-2026-53413 is a zero-click vulnerability — simply being in a meeting with an attacker is enough for them to target you individually through the annotation protocol.
Q2: Has Zoomsday been exploited in the wild?
As of this writing, Zoom has reported no evidence of active exploitation, and no public proof-of-concept exploit is circulating. That said, technical details are now public, so the risk window is closing fast.
Q3: Which Zoom platforms are affected?
The three annotation-related bugs (CVE-2026-53413, -53414, -53415) affect Zoom clients on all supported platforms — Windows, macOS, iOS, and Android. CVE-2026-53416 is specific to Zoom's VDI Client.
Q4: What Zoom versions fix these vulnerabilities?
Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5 fix the annotation flaws. Workplace VDI Client 7.0.11 / 6.6.16 and VDI Plugin 7.0.11 / 6.6.15 fix the path traversal issue.
Q5: Can disabling annotations protect me before I patch?
Yes, as a compensating control. Admins can restrict annotation permissions so only the host can annotate, which reduces — though doesn't fully eliminate — exposure until every endpoint is patched.
Q6: Why is the AI angle of this story significant?
Because the researchers say they built a working exploit chain in under 24 hours using fewer than 20 AI prompts — work that traditionally required nation-state-level resources. It's a preview of how fast future exploit development may move.
Conclusion
Zoomsday is a reminder that "zero interaction required" isn't a rare edge case anymore — it's a realistic outcome of any feature that auto-parses attacker-reachable data without proper bounds checking. Zoom moved quickly to patch all four CVEs, and there's no evidence of in-the-wild exploitation yet. But the technical writeup is now public, the patch is available, and the clock on "responsible disclosure grace period" has run out.
If your organization runs Zoom — and virtually every enterprise does — this is not a "patch when convenient" bulletin. Verify your fleet's version today, prioritize VDI deployments, and push the update centrally rather than hoping end users click "update now."
Found this breakdown useful? Share it with your SOC team, drop your questions in the comments, and subscribe for the next deep dive the moment a new CVE drops.