CVE-2026-53413 · Zoom Clients Annotator Function Out-of-Bounds Write (Zoomsday)

01 · The Real Story

A stranger at the conference table who can reach through the screen and take your laptop — no click required

CVE-2026-53413 is a stack-based buffer overflow in CAnnoFormatBlock::Deserialize within Zoom's libannotate library. The annotation protocol carries four text-formatting fields into fixed 128-byte buffers, but the parser trusts a 32-bit character count from the wire without comparing it to the destination size. An attacker who joins (or hosts) any Zoom meeting can send a single crafted annotation message that overwrites the stack frame — saved registers, return address, the works — and redirects execution to attacker-controlled code. No click, no prompt, no visible indicator. Every Zoom Workplace client before 7.1.0 (or 7.0.6 on the 7.0 branch), Zoom Rooms before 7.1.0, Meeting SDK before 7.1.0, Video SDK before 2.6.0, and VDI Client before 7.0.11 / 6.6.16 are affected across Windows, macOS, Linux, iOS, and Android.

Zoom rated this HIGH / 8.3 and the vendor score is honest. The CVSS vector correctly flags AC:H — exploitation requires platform-specific gadget chains and ASLR bypass, which the researcher demonstrated on macOS ARM64 (a single shared-cache gadget) and Android (heap-spray partial vtable overwrite) but each path demands real exploit-development effort. The vector also tags UI:R because the victim must be *in* a meeting, which is fair: this is not internet-spray-and-pray. That said, Zoom sits on 350 million daily meeting participants and 70% of the Fortune 100, so the pool of reachable victims is enormous. A Security's researchers (Idan Levcovich, Iliya Fayans, Lidor Elias) built a working cross-platform exploit in under 24 hours using fewer than 20 AI prompts, signaling that the AC:H barrier is lower than it looks on paper. On balance, 8.3 HIGH captures the tension between high-friction exploitation and catastrophic blast radius.

"Zero-click RCE lets any Zoom meeting participant silently own every other attendee's machine"

02 · The Attack Path

6 steps from start to impact.

STEP 01

Join or host the target's meeting

The attacker needs to be a participant in the same Zoom meeting as the victim. This can happen via a shared meeting link, calendar invite, social engineering, or simply hosting a meeting and inviting the target. Many enterprises use recurring links with no waiting room enforced, making this step trivially achievable against known targets.

Conditions required:

Valid Zoom meeting link or ability to invite the target
Target must be running an unpatched Zoom client (< 7.1.0 / 7.0.6)

Where this breaks in practice:

Waiting rooms and meeting passwords add a gate
Enterprise SSO-federated meetings limit external joins
Attacker must know or discover the target's meeting schedule

Detection/coverage: Zoom admin audit logs show participant join events; anomalous external joins can be flagged by SIEM integration with Zoom's webhook API.

STEP 02

Craft malicious annotation protocol message

The attacker constructs a Zoom annotation object with an oversized fourth text-formatting field. The 32-bit character count is set to exceed the 128-byte destination buffer in CAnnoFormatBlock::Deserialize. The annotation protocol is proprietary and undocumented, but A Security reverse-engineered it using Frida-based dynamic tracing of libannotate.so within a single session. No public tooling exists yet, but the technique is documented.

Conditions required:

Reverse-engineering knowledge of Zoom's annotation binary protocol
Ability to inject raw protocol messages into the meeting data stream

Where this breaks in practice:

Protocol is proprietary — no public PoC or weaponized tool exists as of October 2026
Requires binary analysis of libannotate to reconstruct message format
A Security demonstrated AI-assisted reverse-engineering in <24 hours, lowering this barrier for skilled attackers

STEP 03

Victim client auto-deserializes the annotation

The victim's Zoom client receives the annotation message through normal meeting infrastructure and passes it to the annotation parser automatically. No user interaction is required — the victim does not need to enable annotations, view the shared screen, or click anything. The parser is always active for any meeting participant. This is the zero-click trigger.

Conditions required:

Victim is in the meeting with an unpatched client
Annotation parsing is enabled (default; cannot be disabled client-side)

Where this breaks in practice:

Zoom deployed server-side filtering on July 15, 2026 that blocks malicious annotation messages for non-E2EE meetings on older clients
If E2EE is enabled, server-side filtering is blind and the message passes through untouched

Detection/coverage: Server-side filtering acts as a detection/prevention layer for non-E2EE meetings. No client-side detection mechanism exists.

STEP 04

Stack buffer overflow overwrites control flow

The oversized character count causes a write past the 128-byte buffer boundary into adjacent stack memory, overwriting saved registers and the return address. On heap-allocated ExtChild objects (592 bytes), the overflow corrupts vtable pointers instead. The attacker controls the overwritten data, enabling precise redirection of program execution.

Conditions required:

Crafted message must survive transport without truncation
Stack/heap layout must be predictable enough for the chosen platform

Where this breaks in practice:

ASLR randomizes memory layout on all modern platforms
Stack canaries may detect corruption on some builds (platform-dependent)
DEP/NX prevents direct shellcode execution from stack

Detection/coverage: EDR solutions monitoring for stack-pivot or ROP chain indicators may flag anomalous execution flow from the Zoom process. CrowdStrike, SentinelOne, and Defender for Endpoint have generic stack corruption detections.

STEP 05

ASLR bypass and code execution

On macOS ARM64, the exploit uses CVE-2026-53414 (an adjacent buffer over-read) to leak heap pointers containing live code addresses, then leverages a single shared-cache gadget (MOV X0,X19; MOV X1,X21; BL execvp) for one-shot RCE. On Android, heap spraying places attacker-controlled C++ objects adjacent to the overflow source, enabling partial vtable pointer overwrites that redirect virtual calls without needing any address leak. Both paths achieve arbitrary code execution in the context of the Zoom process.

Conditions required:

Platform-specific exploit chain (macOS gadget or Android heap spray)
CVE-2026-53414 leak primitive needed for macOS path

Where this breaks in practice:

Exploit must be tailored per OS and architecture
Android path requires heap shaping that may be unreliable across device variants
Windows exploitation path not publicly documented (likely achievable but undemonstrated)

Detection/coverage: EDR should detect anomalous child-process creation from Zoom (e.g., cmd.exe, powershell.exe, /bin/sh spawned by Zoom.exe or zoom.us). Process-tree monitoring is the strongest post-exploitation detection.

STEP 06

Post-exploitation: device takeover

With code execution in the Zoom process context, the attacker gains full control of the endpoint. Demonstrated capabilities include camera/microphone activation, credential harvesting, malware installation, and lateral movement. On domain-joined Windows workstations, this provides an initial-access foothold for Active Directory attack chains. On Zoom Rooms hardware, it enables persistent surveillance of physical conference rooms.

Conditions required:

Successful code execution from step 5

Where this breaks in practice:

EDR/XDR should detect post-exploitation behaviors (credential dumping, lateral movement)
Application sandboxing on iOS/macOS may limit post-exploitation scope
Network segmentation limits lateral movement from compromised endpoint

Detection/coverage: Full EDR telemetry applies: process creation, network connections, file writes, registry modifications from the Zoom process are all observable. Behavioral detections for LSASS access, token manipulation, and C2 beaconing should trigger.

03 · Compensating Control

HIGH 8.3→LOW 2.5

SEVERITY REDUCED

Disable annotations at the account level in Zoom admin portal — Sign in to the Zoom web portal as admin → Account Management → Account Settings → Meeting tab → In Meeting (Basic) → toggle Annotation off and lock the setting. This eliminates the entire attack surface by preventing annotation protocol messages from being processed. Deploy within 30 days per the noisgate mitigation SLA for HIGH findings. This is the single highest-leverage control short of patching.

HIGH 8.3→IGNORE 0.0

SEVERITY REDUCED

Push Zoom client updates to ≥7.1.5 or ≥7.0.6 fleet-wide — Use your endpoint management platform (Intune, SCCM, Jamf, WSUS) to force-update all Zoom Workplace clients. Zoom's MSI/PKG installers support silent deployment. Pin auto-update to the fixed branch. For VDI environments, update to ≥7.0.11 or ≥6.6.16. This is the definitive remediation — deploy within 180 days per the noisgate remediation SLA for HIGH findings, but front-load executive and high-sensitivity endpoints.

HIGH 8.3→HIGH 7.0

Enforce waiting rooms and meeting passwords for all meetings — In Zoom admin settings, enable and lock Waiting Room and Require Passcode for all meeting types. This raises the barrier for an attacker to join meetings uninvited, degrading the initial access step. Not a substitute for patching — a determined attacker with a valid invite or compromised credentials bypasses both controls.

HIGH 8.3→MEDIUM 5.5

SEVERITY REDUCED

Disable E2EE on unpatched clients to enable server-side filtering — Zoom's server-side annotation filter (deployed July 15, 2026) blocks malicious messages but cannot inspect E2EE-encrypted content. If you cannot patch immediately, temporarily disable E2EE at the admin level to ensure the server-side filter protects older clients. This is counterintuitive — you're trading confidentiality protection for integrity protection — but for unpatched clients it is the correct tradeoff. Re-enable E2EE after patching.

HIGH 8.3→HIGH 7.5

Monitor for anomalous Zoom process behavior via EDR — Create EDR detection rules for child-process spawning from Zoom.exe / zoom.us / CptHost.exe (e.g., cmd.exe, powershell.exe, /bin/sh, python). This does not prevent exploitation but catches post-exploitation activity. Deploy within 30 days as a detection backstop.

What doesn't work

End-to-end encryption — E2EE does not help because the attacker is a meeting participant and holds the encryption keys. Worse, E2EE *disables* Zoom's server-side annotation filter, making unpatched clients *more* vulnerable.
Network firewalls / IPS — Zoom traffic flows through Zoom's cloud infrastructure over TLS. Traditional network security tools cannot inspect or block malicious annotation payloads within the encrypted meeting stream.
DLP / email gateways — This is a memory corruption vulnerability triggered by in-meeting protocol messages, not a phishing or data-exfiltration attack. DLP has no role here.
Disabling screen sharing — The annotation parser is reachable even when the victim is not actively viewing a shared screen. Disabling screen sharing does not prevent annotation message processing.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	No confirmed exploitation in the wild as of October 2026. Not listed on CISA KEV. No campaigns attributed to this CVE by any threat intelligence vendor. The Belgium CCB issued a "patch immediately" advisory but cited no active exploitation.
Proof-of-concept availability	Private PoC only. A Security (Idan Levcovich) developed working exploits for macOS ARM64 and Android but did not release code publicly. No public PoC on GitHub, ExploitDB, or Nuclei templates. The `SecureWithUmer/CVE-2026-PoCs` and `asvorg/CVE-2026-PoCs` aggregate repos do not list this CVE. The detailed technical write-up on a.security provides enough protocol-level detail for a skilled researcher to reproduce the bug, but not a turnkey exploit.
EPSS	0.00494 (approximately 49th percentile). Low probability of exploitation in the next 30 days per the FIRST EPSS model, consistent with no public PoC and no observed campaigns.
KEV status	Not listed on CISA Known Exploited Vulnerabilities catalog as of 2026-10-07.
CVSS vector interpretation	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H` — Network-reachable but with high attack complexity (platform-specific exploitation) and user interaction (victim must be in a meeting). Scope change reflects escape from Zoom sandbox to host OS. A Security scored it 9.0 under CVSS 4.0; the delta comes from CVSS 4.0 weighting zero-click-within-context differently.
Affected version ranges	Zoom Workplace all platforms < 7.1.0 (or < 7.0.6 on the 7.0 branch). Zoom Workplace VDI Client (Windows) < 7.0.11 (or < 6.6.16 on the 6.6 branch). Zoom Rooms all platforms < 7.1.0. Zoom Meeting SDK all platforms < 7.1.0. Zoom Video SDK all platforms < 2.6.0.
Fixed versions	Zoom Workplace 7.1.5 / 7.0.6, VDI Client 7.0.11 / 6.6.16, Rooms 7.1.5, Meeting SDK 7.1.5, Video SDK 2.6.0. Available at zoom.us/download. Auto-update pushes began late June 2026.
Server-side mitigation	Zoom deployed server-side annotation filtering on July 15, 2026 that blocks malicious annotation messages before reaching older clients. This mitigation is ineffective for E2EE meetings where the server cannot inspect message content.
Disclosure timeline	June 8, 2026: Discovered by A Security. June 9: RCE confirmed cross-platform. June 10: Reported to Zoom. June 11: Zoom acknowledges. June 22: Client-side fix in v7.1.0. July 15: Server-side filter deployed. August 11: Public disclosure as ZSB-26015.
Researcher / organization	Idan Levcovich (Senior Vulnerability Researcher), with Iliya Fayans and Lidor Elias, at A Security — an autonomous offensive security platform. Exploit developed using AI-assisted analysis in <24 hours with <20 prompts. Dubbed "Zoomsday."
Deployment footprint	Zoom reports 350 million daily meeting participants, 192,600 enterprise customers, 70% of Fortune 100, and extensive federal agency adoption. The attack surface is effectively every corporate endpoint with a Zoom client installed.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (8.3/10)

Why this verdict

Meeting-access gate is real but porous: The attacker must join the victim's meeting, which is a genuine constraint — this is not spray-the-internet. However, shared recurring meeting links, calendar scraping, social engineering invitations, and insider-threat scenarios make meeting infiltration achievable against targeted organizations. This friction is meaningful but does not materially narrow the reachable population for a motivated attacker.
AC:H is honest but eroding: Platform-specific exploitation (ASLR bypass, gadget chains, heap shaping) is genuinely hard. But A Security demonstrated a working cross-platform exploit in under 24 hours using AI-assisted analysis, signaling that AC:H is a speed bump, not a wall, for attackers with modern tooling. No public PoC exists, which currently limits exploitation to well-resourced actors.
Server-side mitigation provides a partial safety net: Zoom's July 2026 server-side filter blocks malicious annotations for non-E2EE meetings, which is the majority of enterprise calls. This meaningfully reduces the exploitable population — but E2EE meetings remain fully exposed, and organizations that have mandated E2EE for compliance reasons are the ones with the most sensitive conversations.
Role multiplier: Zoom is not a canonical high-value infrastructure component (not an IdP, hypervisor, DC, or network edge). It is an *endpoint application* running on corporate workstations, and compromising one Zoom client yields host-level RCE — not fleet-scale or domain-scale impact by itself. However, (a) the installed base is staggering (350M daily participants, 70% of Fortune 100), meaning the *reachable population* is enormous; (b) Zoom Rooms hardware in executive conference rooms represents a persistent surveillance risk if compromised; (c) on domain-joined Windows workstations, this is a high-quality initial-access vector that chains directly into AD attack paths. The blast radius is host-level per exploitation, but the *breadth* of reachable hosts and the sensitivity of meeting content (M&A, legal, board discussions) keep this firmly at HIGH. The floor for a ubiquitous endpoint RCE with zero-click delivery is HIGH.
No exploitation in the wild and low EPSS confirm this is not yet weaponized at scale, but the detailed public write-up and AI-reproducibility mean the window before broader exploitation is narrowing.

Why not higher?

Upgrading to CRITICAL would require either a fully unauthenticated internet-facing attack surface or a canonical high-value infrastructure target. CVE-2026-53413 requires meeting co-presence (not arbitrary remote targeting), has high attack complexity with platform-specific exploitation chains, has no public PoC or observed exploitation, and Zoom is an endpoint application rather than identity/infrastructure software. The server-side mitigation further narrows the exploitable population for non-E2EE meetings. These compounding friction points prevent escalation to CRITICAL.

Why not lower?

Downgrading to MEDIUM would undercount the zero-click delivery, the 350-million-participant attack surface, and the demonstrated cross-platform exploitation reliability. The meeting-access requirement is porous in practice — it is not equivalent to requiring local access or prior compromise. A Security's AI-assisted exploit development in <24 hours signals that AC:H is achievable, not theoretical. The E2EE bypass of server-side mitigations means the most sensitive meetings remain fully exposed. For a fleet manager with 10,000 endpoints, every seat running Zoom is a potential initial-access vector, and that population is too large and too valuable to treat as MEDIUM.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows endpoint where Zoom may be installed. No admin privileges required — reads file version info and registry. Invoke via remote management (Intune, SCCM, GPO logon script) or locally: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-53413.ps1. Exit code 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

<# Check-CVE-2026-53413.ps1
   Detects vulnerable Zoom client versions for CVE-2026-53413
   Output: VULNERABLE | PATCHED | UNKNOWN
   Exit:   1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>
$ErrorActionPreference = 'SilentlyContinue'
$CVE = 'CVE-2026-53413'

# Fixed-version thresholds per release branch
$fixes = @{
  '7.1' = [version]'7.1.0'
  '7.0' = [version]'7.0.6'
  '6.6' = [version]'6.6.16'
}

# Locate Zoom executable in common install paths
$paths = @(
  "$env:ProgramFiles\Zoom\bin\Zoom.exe",
  "${env:ProgramFiles(x86)}\Zoom\bin\Zoom.exe",
  "$env:APPDATA\Zoom\bin\Zoom.exe",
  "$env:LOCALAPPDATA\Programs\Zoom\Zoom.exe",
  "$env:LOCALAPPDATA\Zoom\bin\Zoom.exe"
)
$exe = $paths | Where-Object { Test-Path $_ } | Select-Object -First 1
$raw = $null

if (-not $exe) {
  # Fall back to registry detection
  $regKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
  )
  foreach ($rk in $regKeys) {
    $entry = Get-ItemProperty $rk -EA 0 |
      Where-Object { $_.DisplayName -match 'Zoom\s*(Workplace|Meetings|Rooms)' } |
      Select-Object -First 1
    if ($entry) {
      if ($entry.InstallLocation) {
        $candidate = Join-Path $entry.InstallLocation 'Zoom.exe'
        if (Test-Path $candidate) { $exe = $candidate; break }
      }
      if ($entry.DisplayVersion) { $raw = $entry.DisplayVersion; break }
    }
  }
}

if (-not $exe -and -not $raw) {
  Write-Output "UNKNOWN - Zoom client not detected on this host [$CVE]"
  exit 2
}

if (-not $raw -and $exe) {
  $vi = (Get-Item $exe).VersionInfo
  $raw = if ($vi.ProductVersion) { $vi.ProductVersion } else { $vi.FileVersion }
}

if (-not $raw) {
  Write-Output "UNKNOWN - cannot determine Zoom version [$CVE]"
  exit 2
}

try {
  $clean = $raw -replace '[^0-9.]',''
  $ver = [version]$clean
} catch {
  Write-Output "UNKNOWN - cannot parse version '$raw' [$CVE]"
  exit 2
}

$branch = "$($ver.Major).$($ver.Minor)"

if ($fixes.ContainsKey($branch)) {
  if ($ver -ge $fixes[$branch]) {
    Write-Output "PATCHED - Zoom $raw (>= $($fixes[$branch])) [$CVE]"
    exit 0
  } else {
    Write-Output "VULNERABLE - Zoom $raw (needs >= $($fixes[$branch])) [$CVE]"
    exit 1
  }
} elseif ($ver -ge [version]'7.1.0') {
  Write-Output "PATCHED - Zoom $raw (branch $branch, >= 7.1.0) [$CVE]"
  exit 0
} else {
  Write-Output "VULNERABLE - Zoom $raw (branch $branch unsupported; upgrade to >= 7.1.5) [$CVE]"
  exit 1
}