Zoom has recently addressed four critical security vulnerabilities that could allow malicious meeting participants to execute arbitrary code on another attendee’s device without any user interaction. These zero-click flaws, particularly the one identified as CVE-2026-53413 and dubbed “Zoomsday,” pose significant risks to users across all platforms.
Details of the Vulnerabilities
The most severe of these vulnerabilities, CVE-2026-53413, resides in Zoom’s annotation feature, which enables participants to draw or add text during screen sharing sessions. The flaw stems from improper validation of text-annotation formatting data, allowing an attacker to send a specially crafted message that overflows a buffer and corrupts adjacent memory. This can lead to arbitrary code execution on the victim’s machine without any visible signs of compromise.
In addition to CVE-2026-53413, Zoom disclosed three related issues:
- CVE-2026-53414: A medium-severity buffer over-read vulnerability in Zoom Clients that can leak memory contents.
- CVE-2026-53415: A high-severity use-after-free vulnerability that can lead to memory corruption and potential code execution.
- CVE-2026-53416: A high-severity path traversal weakness in Zoom’s Virtual Desktop Infrastructure (VDI) Client, which could expose sensitive files by allowing an attacker to manipulate file paths outside intended directories.
Impacted Versions and Platforms
These vulnerabilities affect Zoom clients across all supported platforms, including Windows, macOS, Linux, iOS, and Android. The path traversal issue (CVE-2026-53416) is specific to VDI deployments. Zoom has released patches to address these flaws in the following versions:
- Zoom Workplace versions 7.1.5 and 7.0.6
- Zoom Rooms 7.1.5
- Meeting SDK 7.1.5
- Workplace VDI Client versions 7.0.11 and 6.6.16
- VDI Plugin versions 7.0.11 and 6.6.15
Recommendations for Users and Organizations
While there is currently no evidence of these vulnerabilities being exploited in the wild, the zero-click nature of the annotation flaw makes it imperative for users and organizations to apply the available patches promptly. Organizations managing centralized Zoom deployments should push updated installer packages immediately to ensure all users are protected.
These vulnerabilities underscore the importance of regular software updates and vigilant security practices. As video conferencing tools continue to be integral to remote work and communication, maintaining up-to-date software is crucial to safeguarding against emerging threats.
