{"data":{"id":2180,"lang":"en","title":"\"Zoomsday\" Zero-Click Flaws Let Meeting Participants Hijack Other Attendees' Devices","summary":"Researchers found zero-click flaws in Zoom's annotation engine that let a fellow meeting participant silently take over another attendee's device; Zoom patched them on August 11.","category":"technology","category_label":"Technology","published_at":"2026-08-13T10:00:59Z","updated_at":"2026-08-13T10:00:59Z","url":"https://techtools.cz/tools/news/article/2180-zoomsday-zero-click-flaws-let-meeting-participants-hijack-other-attendees","api_url":"https://techtools.cz/news-api/v1/articles/2180?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2180.md?lang=en","image_url":"https://cyberinsider.com/wp-content/uploads/2026/08/Zoom-zero-click-flaw-allowed-RCE-attacks-during-meetings.jpg","word_count":171,"reading_time_minutes":1,"sources":[{"url":"https://www.malwarebytes.com/blog/bugs/2026/08/zoomsday-flaws-could-let-one-zoom-participant-attack-another","domain":"malwarebytes.com"},{"url":"https://cyberinsider.com/zoom-zero-click-flaw-allowed-rce-attacks-during-meetings/","domain":"cyberinsider.com"}],"translation":{"lang":"cs","id":2253,"title":"Chyby „Zoomsday“ umožňují účastníkům videohovoru napadnout zařízení ostatních bez jediného kliknutí","url":"https://techtools.cz/tools/news/clanek/2253-chyby-zoomsday-umoznuji-ucastnikum-videohovoru-napadnout-zarizeni-ostatnich-bez","api_url":"https://techtools.cz/news-api/v1/articles/2253?lang=cs"},"content":"Security researchers at A.Security disclosed a set of vulnerabilities in Zoom's annotation engine, dubbed \"Zoomsday,\" that let a malicious participant in a video call compromise another attendee's device without any clicks, downloads, or prompts. Simply joining the same meeting was enough to be exposed.\n\nThe flaws — CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415 — stem from Zoom's annotation parser trusting length and count values sent over the network without checking them against fixed-size buffers. A researcher demonstrated real-world code execution on macOS by silently launching Safari on a victim's machine, with no visible sign anything had happened. The bugs affect Zoom Workplace, Zoom Rooms, and the Meeting SDK across Windows, macOS, Linux, iOS, and Android.\n\nResearchers rated the flaws Critical, while Zoom rated the worst of them High, arguing that exploitation still requires an attacker to be present in the meeting. Zoom shipped fixes on August 11 in Workplace versions 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, Meeting SDK 7.1.5, and matching VDI client/plugin updates. Zoom says it has seen no evidence of active exploitation."}}