Zoom has patched a serious vulnerability in its annotation feature that could allow one meeting participant to achieve remote code execution on another participant’s device.
The flaw, tracked as CVE-2026-53413, affects Zoom’s client-side annotation functionality. Zoom’s own bulletin describes the issue as a missing bounds check in the annotator function that can lead to a buffer overwrite and may allow a meeting participant to execute code on another participant’s client via network access. Zoom rates the issue High, with a CVSS score of 8.3.
The research team that discovered the issue, A Security, dubbed the exploit chain “Zoomsday.” The company said the bug could let an attacker either host or join a meeting and target another participant, with no victim click, download, or visible sign of compromise.
What Happened
The vulnerability sits inside Zoom’s annotation feature — the tool that allows participants to draw, type, highlight, or add shapes on shared screens and whiteboards.
According to SC Media’s technical summary of the research, Zoom’s annotation data is serialized into internal objects, packaged into protocol messages, routed through Zoom’s meeting infrastructure, and then deserialized by the receiving client. The vulnerable code path involved how Zoom handled text annotation formatting data inside its annotation library.
The problem was not that users misconfigured their meetings.
The problem was that a malicious participant could send specially crafted annotation data that another client would parse. If handled by a vulnerable version, that parsing could corrupt memory and open a path to code execution.
In simple terms: a feature designed for drawing on shared screens became a possible attack path between meeting participants.
Why This Is So Serious
This type of vulnerability is dangerous because Zoom meetings often include people from different organizations.
A user might join a sales call, vendor meeting, webinar, interview, support session, or external collaboration call with people they do not fully trust. If one participant can attack another participant’s client from inside the meeting, the meeting itself becomes the delivery channel.
A Security warned that once malicious code runs on a victim’s device, an attacker could potentially steal data, activate the microphone or camera, or install additional malware.
That makes the impact bigger than a disrupted call.
It becomes an endpoint compromise risk.
A Cross-Platform Issue
Zoom’s advisory lists several affected product families, including Zoom Workplace, Zoom Workplace VDI Client for Windows, Zoom Rooms, and Zoom Meeting SDK across supported platforms. Fixed versions include Zoom Workplace 7.1.5 and 7.0.6 in their respective branches, VDI Client for Windows 7.0.11 and 6.6.16, Zoom Rooms 7.1.0, and Meeting SDK 7.1.0.
That breadth matters.
Zoom is not just a desktop app. It is used across Windows, macOS, Linux, mobile devices, meeting rooms, VDI environments, and embedded meeting SDKs.
Enterprises therefore need to think beyond updating one workstation image. They need to check managed endpoints, virtual desktop images, meeting rooms, SDK-based apps, and any devices that may not update automatically.
The AI Angle
One of the most striking parts of the story is how quickly the research was reportedly completed.
A Security said it found the issue in a single working day using an AI agent and publicly available AI models. The Verge reported that the exploit was uncovered with fewer than 20 prompts, underscoring how AI-assisted vulnerability research is compressing the time needed to find and weaponize complex bugs.
This does not mean AI created the vulnerability.
It means AI helped researchers move faster through reverse engineering, bug discovery, and exploit development.
For defenders, that is the bigger lesson. Software that once seemed too complex or proprietary to analyze quickly may now be examined at machine speed by researchers — and eventually by attackers.
What the Flaw Says About Collaboration Tools
Modern collaboration platforms are no longer simple video-call tools.
They include screen sharing, annotation, whiteboards, chat, file transfer, remote control, AI assistants, apps, SDKs, and integrations. Every feature adds code. Every code path that processes data from another participant becomes part of the attack surface.
Annotation is especially sensitive because it is interactive. It has to accept live input from other users, interpret shapes and text, sync state between clients, and render that data in real time.
That makes it convenient.
It also makes it risky if parsing logic fails.
What Organizations Should Do
The priority is to update all Zoom clients and related products to fixed versions.
Security teams should verify:
- Zoom Workplace versions on employee endpoints
- VDI client versions
- Zoom Rooms versions
- Meeting SDK versions inside internal or customer-facing applications
- unmanaged devices used by executives or remote staff
- meeting-room appliances and shared conference systems
Zoom’s bulletin directs users to apply the latest available updates to stay protected.
Organizations should also consider reducing unnecessary meeting features in high-risk environments. Zoom allows admins to enable or disable annotation at the account, group, or user level, and also offers an option to allow only the person sharing to annotate.
That does not replace patching, but it reduces exposure from features that many companies may not need in every meeting.
Practical Mitigations
Recommended defensive steps include:
- update Zoom Workplace to fixed versions immediately
- update Zoom Rooms and VDI images
- inventory apps using Zoom Meeting SDK
- disable annotation where it is not required
- restrict participant annotation in external meetings
- require authenticated users for sensitive calls
- avoid joining high-risk calls from privileged admin workstations
- monitor for unusual child processes spawned by collaboration apps
- use EDR controls on systems that regularly join external meetings
- keep meeting-room devices in the patch-management program
For particularly sensitive meetings, organizations may also consider using isolated browser sessions, dedicated meeting devices, or hardened virtual desktops when joining calls with unknown external participants.
Why Patching Alone Is Not the Whole Lesson
The immediate fix is straightforward: update Zoom.
But the broader lesson is about exposure inside trusted collaboration spaces.
Enterprises often treat meetings as safe once attendees are admitted. This incident shows that every participant is also a potential data source sending structured input to every other client.
That changes the trust model.
A meeting invite is not just a communication event. It is a temporary network of clients exchanging media, metadata, chat, control signals, screen-share data, and feature-specific protocol messages.
If one of those parsers breaks, the meeting becomes an attack surface.
Final Thoughts
The Zoom annotation vulnerability is a reminder that collaboration software is now critical infrastructure.
A flaw in a screen annotation feature could allow one participant to compromise another participant’s client. That risk is especially serious because modern work depends on meetings with vendors, customers, partners, candidates, contractors, and external guests.
Zoom has released fixes, and organizations should deploy them quickly.
As AI accelerates vulnerability discovery, defenders need faster patching, stricter feature control, better endpoint monitoring, and a more cautious approach to software that processes live input from untrusted users. In 2026, even a meeting annotation tool can become an entry point.
