Zoom Had a Flaw That Let Hackers Take Over Your Computer During a Meeting, Without You Clicking Anything
A vulnerability in Zoom's annotation feature gave attackers a direct path to run code on any participant's machine. Patches are out now.
Key points
- CVE-2026-53413, rated as a severe flaw, allowed an attacker to silently take over another person's computer during any Zoom meeting, with no click or action required from the victim.
- The bug was found by security firm A Security, which named it "Zoomsday" and held its public disclosure until after Zoom had pushed both a client patch and a server-side fix.
- Zoom Workplace versions 7.1.5 and 7.0.6 contain the fix, released Tuesday, covering all supported platforms.
- Three of the four patched vulnerabilities lived inside Zoom's annotation feature, the tool that lets participants draw on a shared screen.
- Anyone still running an older Zoom client should update immediately.
Zoom fixed four security flaws on Tuesday, the worst of which let a criminal silently take over any meeting participant's computer, no click, no prompt, no warning on screen.
The bug, tracked as CVE-2026-53413, is what researchers call a "zero-click remote code execution" flaw. In plain terms: an attacker who joined or hosted a Zoom call could send a specially crafted, invisible message to another participant's Zoom app, and that message would force the app to run the attacker's own instructions on the victim's machine. The victim would see nothing unusual.
How did this work?
The attack used Zoom's annotation feature, the tool that lets people draw or type on a shared screen. That feature runs on a custom, private protocol that Zoom built in-house, and it opens a direct data channel between whoever is sharing their screen and whoever is watching.
A Security, the firm that found the bug and named it Zoomsday, discovered that Zoom's app automatically processed every message it received through this channel without properly checking the message's size. An attacker could send an oversized message that wrote extra data beyond the space the app had set aside for it, a technique called a "buffer overflow." That overflow let the attacker slip their own code into the app's memory and run it.
Because the protocol creates individual channels between a host and each viewer, an attacker could target participants one by one.
"The exploit enables attackers to either join or host a meeting, target any participant, and take over their machine with no required action from the victim and no visual cue," A Security wrote in its disclosure.
A Security waited to publish until Zoom had shipped both a client update and a server-side block, a responsible-disclosure process that gives users time to patch before criminals learn the details.
What else was fixed?
Two more bugs in the same annotation feature were patched alongside Zoomsday.
| CVE | Type | Effect |
|---|---|---|
| CVE-2026-53413 | Memory corruption | Attacker runs code on victim's machine |
| CVE-2026-53414 | Bounds check missing | Crashes the victim's Zoom app (denial of service) |
| CVE-2026-53415 | Use-after-free (memory error) | Zoom found this one independently before A Security reported it |
| CVE-2026-53416 | Path traversal | Exposes files on Windows VDI systems |
The fourth flaw, CVE-2026-53416, affected the Zoom VDI client, a version of Zoom used in corporate virtual-desktop environments. It let attackers read files they should not have access to.
Should you update right now?
Yes. Open Zoom, click your profile picture, and choose "Check for Updates." You want Zoom Workplace version 7.1.5 or 7.0.6 (or higher) on any device, and Rooms or Meeting SDK version 7.1.5 if your workplace uses those. Zoom's security bulletin lists every affected product.
If your employer manages Zoom through IT, ask whether the update has been pushed. Until it has, treat any unexpected meeting invite with caution.
