Zoom Had a Flaw That Let Hackers Take Over Your Computer During a Meeting, Without You Clicking Anything
A vulnerability in Zoom's annotation feature gave attackers a direct path to run code on any participant's machine. Patches are out now.
Key points
- CVE-2026-53413, rated as a severe flaw, allowed an attacker to silently take over another participant's computer during a Zoom meeting, with no interaction required from the victim.
- The bug was found by security firm A Security, which named it "Zoomsday" and held public disclosure until Zoom had pushed both a client patch and a server-side fix.
- Zoom Workplace versions 7.1.5 and 7.0.6 contain the fix, released Tuesday, covering all supported platforms.
- Three of the four patched vulnerabilities lived inside Zoom's annotation feature, the tool that lets participants draw on a shared screen.
- Anyone still running an older Zoom client should update immediately.
Zoom fixed four security flaws on Tuesday, the worst of which let an attacker silently take over any meeting participant's computer: no prompt, no warning on screen.
The bug, tracked as CVE-2026-53413, is what researchers call a "zero-click remote code execution" flaw. An attacker who joined or hosted a Zoom call could send a specially crafted, invisible message to another participant's Zoom app, forcing it to run the attacker's own instructions on that machine. Nothing on screen would look wrong.
How did this work?
The attack exploited Zoom's annotation feature, which runs on a proprietary protocol and opens a direct data channel between whoever is sharing a screen and whoever is watching. Zoom's app automatically processed every message it received through that channel without properly checking the message's size. An attacker could send an oversized message that wrote data beyond the space the app had reserved, a technique called a buffer overflow, and use that overflow to slip their own code into the app's memory and execute it.
Because the protocol creates individual channels between participants, an attacker could target them one by one.
"The exploit enables attackers to either join or host a meeting, target any participant, and take over their machine with no required action from the victim and no visual cue," A Security wrote in its disclosure.
A Security waited to publish until Zoom had shipped both a client update and a server-side block. This is the third Zoom patch cycle we've reported since July, and the pattern is consistent: Zoom found its own account-takeover bug in mid-July before disclosing it, and the same happened here with CVE-2026-53415.
What else was fixed?
Two more bugs in the same annotation feature were patched alongside Zoomsday.
| CVE | Type | Effect |
|---|---|---|
| CVE-2026-53413 | Memory corruption | Attacker runs code on victim's machine |
| CVE-2026-53414 | Bounds check missing | Crashes the victim's Zoom app (denial of service) |
| CVE-2026-53415 | Use-after-free (memory error) | Zoom found this one independently before A Security reported it |
| CVE-2026-53416 | Path traversal | Exposes files on Windows VDI systems |
The fourth flaw, CVE-2026-53416, affected the Zoom VDI client, a version of Zoom used in corporate virtual-desktop environments, and let attackers read files they shouldn't have access to.
Should you update right now?
Yes. Open Zoom, click your profile picture, and choose "Check for Updates." You want Zoom Workplace version 7.1.5 or 7.0.6, and Rooms or Meeting SDK version 7.1.5 if your workplace uses those. Zoom's security bulletin lists every affected product.
If your employer manages Zoom centrally, check whether the update has been pushed. The zero-click nature of CVE-2026-53413 is what makes this one press: an attacker needs only to share a call with you.
