Zoom Zero-Click Vulnerability Lets Attackers Run Malicious Code On Devices Without User Action

A Zoom meeting could become an entry point for attackers to take control of a participant’s device without requiring the victim to click a link, download a file or approve an action, according to newly disclosed vulnerabilities in the platform’s annotation system.

The flaws, discovered by Israeli cybersecurity firm A Security and dubbed “Zoomsday”, allowed a malicious participant to send specially crafted annotation data that could corrupt memory on another attendee’s device and potentially achieve remote code execution.

The disclosure is particularly relevant to crypto users and other high-value targets who routinely join online meetings with people they do not know personally.

How The Zoomsday Attack Could Take Over A Device

The vulnerabilities sit in Zoom’s annotation functionality, which allows participants to draw, add text and share other content during meetings.

A Security found that the proprietary protocol used by the feature automatically processes incoming data, creating an avenue for malicious messages to reach other participants.

The most serious flaw, CVE-2026-53413, involved a missing bounds check in the text annotation system.

By sending data designed to write beyond the intended memory area, an attacker could potentially execute their own code on another participant’s machine.

A Security said its researchers were able to exploit the issue because “every Zoom client automatically parses whatever it receives, sending a specially crafted message to corrupt the receiving client’s memory and run code on it.”

The attack could be carried out by someone hosting or joining a meeting, with individual participants targeted through the direct communication channel created by the annotation protocol.

The firm said,

“The exploit enables attackers to either join or host a meeting, target any participant, and take over their machine with no required action from the victim and no visual cue indicating the compromise.”

The researchers also identified CVE-2026-53415, a use-after-free vulnerability that could also lead to remote code execution, while CVE-2026-53414 could be exploited to cause a denial-of-service condition through a buffer overread.

CVE-2026-53413 and CVE-2026-53415 were assigned high-severity CVSS scores of 8.3, while CVE-2026-53414 was rated medium severity.

AI Helped Researchers Build The Exploit Quickly

A Security reported the vulnerabilities to Zoom in June after researchers used publicly available AI models and an offensive security testing system to investigate the software.

The firm said fewer than 20 prompts were enough to help identify the flaws and develop a working exploit in under 24 hours.

The researchers delayed public disclosure while Zoom prepared client-side fixes and server-side protections, given that a successful zero-click exploit would not require any action from the targeted user.

A Security said,

“Because a zero-click RCE requires no user interaction, we prioritized giving customers time to receive both the client patch and the server-side mitigation before publishing.”

The incident shows how AI-assisted security research can accelerate the discovery and testing of vulnerabilities in widely used software, while also giving defenders less time to respond once a serious flaw is found.

Why Zoom’s End-To-End Encryption Creates A Problem

Zoom has introduced server-side protections designed to identify and block malicious annotation messages before they reach vulnerable clients.

That protection, however, has an important limitation.

Zoom cannot inspect traffic inside end-to-end encrypted meetings because the encrypted content is inaccessible to its servers.

As a result, users running vulnerable versions of the Zoom client could remain exposed when using E2EE meetings, even with the server-side mitigation in place.

End-to-end encryption needs to be turned off to keep outdated, vulnerable clients safe. (Source: A Security)

Security experts therefore said updating the Zoom client remains the most reliable protection.

Douglas McKee, director of vulnerability intelligence at Rapid7, said,

“For managed environments, enforce minimum client versions rather than relying on users to update themselves.”

He also recommended reducing the number of people who can reach the attack surface by using waiting rooms, authenticated-user requirements and passcodes, while restricting features such as annotation where they are not needed.

Which Zoom Versions Need To Be Updated?

Zoom has released fixes across supported platforms for the affected products.

Workplace users should upgrade to version 7.1.5 or 7.0.6, depending on their maintained branch.

Zoom Rooms version 7.1.5 and Meeting SDK version 7.1.5 also contain fixes for the three annotation vulnerabilities.

The company separately patched CVE-2026-53416, a path traversal vulnerability that could lead to information disclosure, in Workplace VDI Client for Windows versions 7.0.11 and 6.6.16 and Workplace VDI Plugins versions 7.0.11 and 6.6.15.

Security researchers said endpoint protection tools should not be treated as a substitute for installing the patches.

Why The Vulnerability Matters To Crypto Users

The ability to compromise a device during a meeting creates a serious risk for people who manage digital assets from the same computer.

A successful attacker could potentially access exchange accounts, wallet applications, private documents, credentials and other information stored on the device.

A Security said malicious code running on a victim’s machine could also be used to steal personal information, activate the microphone or camera, or install additional malware.

The risk is more pronounced in the crypto sector, where attackers have repeatedly used fake Zoom meetings and social engineering to target industry professionals.

North Korean-linked threat actors have previously used compromised Telegram accounts and deepfake video calls to persuade victims to install malware disguised as software needed to resolve meeting problems.

THORChain co-founder JP Thor lost about $1.3 million in September 2025 after joining what appeared to be a legitimate Zoom meeting.

The newly disclosed vulnerabilities remove one of the hurdles traditionally used in such attacks: persuading the victim to install malicious software.

With a vulnerable Zoom client, an attacker who successfully gains access to the same meeting could potentially exploit the device without first convincing the participant to download a fake update.

Security Teams Are Urged To Reduce The Attack Surface

A Security said organisations can look for unusual behaviour following suspected exploitation attempts.

The researchers noted that a Zoom client has little reason to launch a browser, shell or script interpreter during a normal meeting, making such activity potentially useful for detection.

They also recommended collecting application crash reports centrally because failed memory-corruption attempts can cause crashes before an attacker manages to achieve reliable code execution.

For meetings involving untrusted participants, A Security CEO Yossi Torati said,

“For calls with untrusted parties, a browser client or a dedicated VM meaningfully reduces exposure.”

The immediate defence, however, remains straightforward: update affected Zoom software, limit unnecessary meeting access and avoid relying on server-side filtering where end-to-end encryption prevents Zoom from inspecting the traffic.