Missing bounds check in the annotator function of Zoom Clients

CVE-2026-53413, dubbed Zoomsday by its discoverer, is a stack buffer overflow in CAnnoFormatBlock::Deserialize, the routine that parses text-annotation formatting data exchanged between Zoom meeting participants during screen sharing. The function uses four fixed-size 128-byte buffers but trusts a 32-bit character-count field supplied over the wire, allowing an attacker to write past the buffer boundary with controlled data. Exploitation requires only that the attacker participate in (or host) the same Zoom meeting as the victim — no click, no prompt, no visual indicator. All Zoom Workplace desktop and mobile clients before 7.1.5 / 7.0.6, VDI Client before 7.0.11 / 6.6.16, Rooms before 7.1.5, and Meeting SDK before 7.1.5 are affected across Windows, macOS, Linux, iOS, and Android.

Zoom rated this HIGH at CVSS 3.1 / 8.3, setting AC:H and UI:R. Both modifiers are generous. The discoverer (Idan Levcovich, A Security) achieved a working RCE exploit within 24 hours of finding the bug, which argues against high attack complexity. The 'user interaction' amounts to the victim being in a meeting where screen sharing is active — which describes the majority of Zoom usage. The CVSS 4.0 score from the researcher is 9.0. Zoom's own label undersells the practical severity of a zero-click, cross-platform, remotely-triggerable RCE in a client installed on 300 million+ daily active endpoints spanning every tier of the enterprise.

Why this verdict

• Zero-click attack surface: The victim needs only to be in a Zoom meeting where screen sharing is active. No click, no prompt, no visual indicator. This is the default state of most business meetings.
• Ubiquitous deployment eliminates targeting friction: With 300M+ daily users and 55% market share, the affected client is on virtually every corporate endpoint — from intern laptops to CEO workstations to domain admin machines. The attacker chooses their target by choosing which meeting to join.
• Confirmed private weaponization: A Security achieved working RCE within 24 hours of discovery. The gap between advisory publication and public PoC is typically days to weeks for bugs of this profile. The clock is ticking.
• Cross-platform blast radius: Windows, macOS, Linux, iOS, and Android are all affected. A single exploit chain concept applies across the entire fleet — no platform is a safe harbor.
• Role multiplier: Zoom is not itself a high-value-role component, but it runs on *every* high-value endpoint. Domain admins, backup operators, CI/CD engineers, and executives all use Zoom daily. A targeted attack during an IT team standup or board meeting puts the attacker one hop from domain controllers, backup infrastructure, or strategic data. The Zoom VDI Client specifically runs in virtual desktop infrastructure where compromise can pivot into the hypervisor management plane. The blast radius is effectively host→domain→fleet for any meeting containing a privileged user, which is the majority of IT and leadership meetings.

Why not higher?

This is already rated CRITICAL at 9.0. A 10.0 would require wormable, no-authentication, no-meeting-presence exploitation — e.g., a listening service exploitable from the internet. The meeting-presence requirement, while low-friction, is a real gate that prevents fully autonomous propagation.

Why not lower?

Downgrading below CRITICAL would require dismissing the zero-click nature, the confirmed private exploit, and the near-universal enterprise install base. The AC:H in the vendor vector is contradicted by the researcher's 24-hour exploit development timeline. The UI:R is effectively 'be in a meeting,' which is what Zoom is for. No single friction point narrows the reachable population below the threshold for CRITICAL.

1. Disable annotation in Zoom admin console immediately — In the Zoom Admin Portal → Settings → In Meeting (Basic), disable Annotation. This removes the attack surface entirely by preventing the annotation PDU channel from being established. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL findings. This is the single highest-impact control.
2. Enforce waiting rooms and meeting passcodes — Prevent unauthorized participants from joining meetings. In admin settings, require Waiting Room and Passcode for all meetings. This adds a gate at Step 1 of the attack path. Already a best practice but now a security-critical control.
3. Restrict screen sharing to host-only where feasible — Limiting screen sharing to hosts reduces the attacker's ability to self-initiate the annotation channel. Configure via admin policy. Note: this does NOT fully mitigate — a legitimate host sharing screen still exposes viewers.
4. Push auto-update or force minimum version via MDM — Use your MDM (Intune, Jamf, SCCM) to enforce Zoom Workplace ≥ 7.1.5 or ≥ 7.0.6 LTS. Set the minimum allowed version to block older clients from launching. For VDI, push 7.0.11 / 6.6.16 through your VDI image pipeline.
5. Monitor for anomalous Zoom process behavior via EDR — Create detection rules for Zoom spawning unexpected child processes (cmd.exe, powershell.exe, /bin/sh, python), writing to temp directories, or making unusual network connections. This catches post-exploitation but not the initial overflow.

Run on each Windows endpoint (or via your RMM/MDM script runner) with standard user privileges. For macOS/Linux, adapt the version check path. Example: powershell -ExecutionPolicy Bypass -File .\Check-ZoomCVE202653413.ps1

#!/usr/bin/env pwsh
# Check-ZoomCVE202653413.ps1
# Checks whether installed Zoom Workplace client is vulnerable to CVE-2026-53413
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$FixedVersionMain = [version]'7.1.5'
$FixedVersionLTS  = [version]'7.0.6'

function Get-ZoomVersion {
    # Try registry (per-user and per-machine)
    $regPaths = @(
        'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
    )
    foreach ($path in $regPaths) {
        $entries = Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
            Where-Object { $_.DisplayName -match 'Zoom Workplace|Zoom Meeting' }
        if ($entries) {
            return [version]($entries[0].DisplayVersion -replace '[^0-9.]','')
        }
    }
    # Fallback: check file version of Zoom.exe
    $zoomExe = "$env:APPDATA\Zoom\bin\Zoom.exe"
    if (Test-Path $zoomExe) {
        $fv = (Get-Item $zoomExe).VersionInfo.ProductVersion
        return [version]($fv -replace '[^0-9.]','')
    }
    return $null
}

$ver = Get-ZoomVersion

if (-not $ver) {
    Write-Output 'UNKNOWN - Zoom Workplace not detected on this host.'
    exit 2
}

Write-Output "Detected Zoom version: $ver"

# 7.1.x branch: fixed in 7.1.5+
if ($ver.Major -eq 7 -and $ver.Minor -ge 1) {
    if ($ver -ge $FixedVersionMain) {
        Write-Output 'PATCHED - Zoom version is >= 7.1.5.'
        exit 0
    } else {
        Write-Output 'VULNERABLE - Zoom 7.1.x below 7.1.5. Update immediately.'
        exit 1
    }
}

# 7.0.x branch (LTS): fixed in 7.0.6+
if ($ver.Major -eq 7 -and $ver.Minor -eq 0) {
    if ($ver -ge $FixedVersionLTS) {
        Write-Output 'PATCHED - Zoom version is >= 7.0.6 (LTS).'
        exit 0
    } else {
        Write-Output 'VULNERABLE - Zoom 7.0.x below 7.0.6. Update immediately.'
        exit 1
    }
}

# Anything older than 7.0 is vulnerable
if ($ver -lt [version]'7.0.0') {
    Write-Output 'VULNERABLE - Zoom version predates all fixed branches. Update immediately.'
    exit 1
}

Write-Output "UNKNOWN - Unexpected version $ver. Verify manually."
exit 2

Sources

1. A Security — Zoomsday Technical Writeup
2. SecurityWeek — Zoom Patches Zero-Click Code Execution Vulnerability
3. The Hacker News — Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client
4. Security Affairs — Zoom Patches Zoomsday Zero-Click Flaw
5. CyberInsider — Zoom Zero-Click Flaw Allowed RCE Attacks During Meetings
6. CybersecurityNews — Zoom Zero-Click Vulnerabilities Allow Meeting Participants to Hijack Devices
7. CVE Record — CVE-2026-53413
8. Tenable — Zoom Workplace VDI Client Vulnerability ZSB-26015