CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415 — three flaws in Zoom's annotation code — could have let a meeting participant seize control of other attendees' clients without any click, download or visible prompt.
The CVEs, the patches, and the immediate risk
Zoom has tracked the three defects as CVE-2026-53413 (CVSS 8.3), CVE-2026-53414 (CVSS 6.5) and CVE-2026-53415 (CVSS 8.3), and published bulletins ZSB-26015, ZSB-26016 and ZSB-26017. Vendor fixes shipped to clients in June and July — roughly two months before the flaws were made public — and, as of publication, no exploitation has been reported. None of the three identifiers appears in CISA's Known Exploited Vulnerabilities catalog.
The versions that close the issues are specific to product branches: Zoom Workplace (all supported platforms) before 7.1.5 and 7.0.6 in their respective branches; Zoom Workplace VDI Client for Windows before 7.0.11 and 6.6.16; and Zoom Rooms and Zoom Meeting SDK (all platforms) before 7.1.0, and before 7.1.5 for the third flaw.
How the annotation channel could be weaponized
Zoom published no technical detail; the public explanation of the internals comes from reverse engineering by the Israeli-founded offensive-security startup A Security. According to that writeup, drawings shared via the annotation feature are not sent as pictures but as structured objects: a run of counts followed by data. The receiver trusts those counts to decide how much to read.
One object contains a fixed 128-byte buffer with no check that incoming data fits; because it is the object's last field, an oversized count can run past the end and over the return address. What lets a malformed drawing reach the whole room, the researchers say, is a missing check on message origin. Every viewer holds a channel to whoever is sharing, and the sharer holds one back for acknowledgements.
On the paths the researchers traced, the dispatcher reads a message's type number off the wire and hands it to the matching parser without asking which seat the sender occupied. The writeup identifies two type numbers: 0x10001 meaning “here is an object,” and 0x10002 meaning “I received yours.” If the first is sent where the second belongs, the victim's client rebuilds the object in full — and a malformed object can then trigger a conventional memory-corruption attack.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildDisagreement on impact and scoring
The two accounts diverge on at least one substantive claim. A Security reports that the buffer over-read recovered uninitialized heap memory containing live code and vtable pointers — the kind of material an address-randomization bypass needs. Zoom's advisory, by contrast, characterizes that same bug as possibly allowing a participant to "conduct a denial of service," and scores its confidentiality impact at none.
Zoom's own bulletins apply CVSS 4.0 scores of 9.0 to all three flaws in internal records, a figure that does not appear in the public CVE records. The company issues its own CVE records and NIST no longer routinely re-scores them, so the lower public figures will likely stand. All three vendor vectors also mark user interaction as required — a statement that sits uneasily beside the zero-click framing in A Security's public writeup.
A Security, reverse engineering, and the AI claim
A Security — the startup that left stealth in June with $37 million in funding — says it went from finding the flaw to a working exploit in under a day, using fewer than 20 prompts on publicly available AI models. The writeup names Idan Levcovich as its researcher on two of the bulletins; the bulletin covering the use-after-free credits Zoom Offensive Security.
The post acknowledges complexities: the automated first pass — an automated ranking of functions reachable from the Java layer — produced a queue of 3,762 functions across 70 libraries and initially missed the vulnerable library entirely, ranking it 45th. The vulnerability surfaced only when the team traced the running client through a live call, feature by feature. Levcovich writes that the barrier to building this class of exploit "has collapsed, and it will not come back."
This disclosure coincides with OpenAI splitting its Daybreak program a day earlier and releasing GPT-5.6-Cyber to vetted partners only; A Security says it used models "anyone can use," while OpenAI's own measure — cited in the report — states its guardrailed public model answers 1.5% of advanced offensive-security prompts versus 95% for the restricted one.
What this means for technologists, enterprises, and end users
- Technologists and security teams: confirm that clients are updated to the patched versions listed for Zoom Workplace, VDI, Zoom Rooms and the Meeting SDK; note the discrepancy between vendor and independent severity assessments when prioritizing mitigations.
- Enterprises and procurement leaders: audit deployed Zoom branches against the version matrix above and check whether server-side filters or mitigations (such as the one Zoom reported filtering before the report arrived) are active in your environment.
- End users and meeting hosts: be aware that the reported attack requires only meeting presence and uses the annotation channel; ensure clients are patched and consider limiting annotation rights where feasible until updates are confirmed.
For now the practical story is simple and precise: patches are available and were distributed months before the public writeup, and no exploitation has been reported. The sharper questions — how widely the technical details diffuse, how defenders should weight competing impact estimates, and whether automated tools will make exploit development meaningfully easier — all hinge on further disclosures and independent verification.
https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html
