Security researchers at A.Security disclosed a set of vulnerabilities in Zoom's annotation engine, dubbed "Zoomsday," that let a malicious participant in a video call compromise another attendee's device without any clicks, downloads, or prompts. Simply joining the same meeting was enough to be exposed.
The flaws — CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415 — stem from Zoom's annotation parser trusting length and count values sent over the network without checking them against fixed-size buffers. A researcher demonstrated real-world code execution on macOS by silently launching Safari on a victim's machine, with no visible sign anything had happened. The bugs affect Zoom Workplace, Zoom Rooms, and the Meeting SDK across Windows, macOS, Linux, iOS, and Android.
Researchers rated the flaws Critical, while Zoom rated the worst of them High, arguing that exploitation still requires an attacker to be present in the meeting. Zoom shipped fixes on August 11 in Workplace versions 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, Meeting SDK 7.1.5, and matching VDI client/plugin updates. Zoom says it has seen no evidence of active exploitation.