SAN JOSE, 13 AUG 2026 — Zoom patched four flaws in its annotation feature on 11 August. The worst of them lets one meeting participant run code on another participant's machine with no click and no visible sign. The bug is serious, but how it was found is the real story: under 24 hours, fewer than 20 prompts.
The researchers at A Security who found it call the chain Zoomsday. Their claim is that a single person went from a decompiled Zoom binary to a working zero-click remote code execution across every native client in one working day, driving publicly available models.
What the bug actually is
CVE-2026-53413 is a stack buffer overflow in the annotation parser — the code behind the drawing and highlighting tools that appear over a shared screen. Zoom rates it high, CVSS 8.3.
The mechanism is an old one. A structure holds four fixed 128-byte buffers. The parser reads a 32-bit count off the wire and then trusts that count to decide how much to copy in. Nothing checks it against the space available, so the copy runs off the end of the buffers, through the stack frame, into the saved registers and the return address.
Two details elevate it above a routine parsing bug.
First, annotation does not have to be in use. The code path is present and listening whether or not anybody is drawing on anything, so there is no user behaviour to avoid.
Second, there is a routing quirk. Annotation messages travel through Zoom's multimedia router, and on the receiving side nothing enforces that the downstream channel carries only acknowledgements. In A Security's account, the opcode for "here is an object" is 0x10001 and the opcode for "I received your object" is 0x10002. One increment separates them, and the code that dispatches on the opcode cannot tell which seat the sender occupied. A participant can therefore speak on a channel that was meant to carry server-to-client traffic.
The other three
| CVE | What it gives an attacker |
|---|---|
| CVE-2026-53413 | Stack overflow in the annotation parser. High, CVSS 8.3. The code-execution primitive. |
| CVE-2026-53414 | Over-read. A large wire count against a short payload returns live heap memory — vtable pointers and module bases, which is the material for defeating address randomisation. Medium. |
| CVE-2026-53415 | Attacker-controlled bytes written into a linked-list structure with no pointer validation. Zoom had identified this one independently. High. |
| CVE-2026-53416 | Path traversal leading to information disclosure. High. |
Read together, they form a complete exploit kit: a leak to locate memory, a write to redirect execution, and an overflow to take the return address.
One discrepancy we could not settle
Zoom's own bulletin scores CVE-2026-53413 with a vector that includes UI:R — user interaction required. A Security describes the same flaw as needing "no required action from the victim and no visual cue indicating the compromise".
Zoom likely counts joining the meeting as the required interaction — a defensible reading of a scoring standard that was not designed for this shape of attack. We could not confirm that, and it matters, because a defender triaging by vector alone will file UI:R under "needs the user to fall for something" and rank it lower than it deserves. Take the description over the vector here.
The timeline, which is the story
libannotate.so after dynamic tracing of a live call.Nine weeks from report to patch is a respectable vendor response. The 24 hours in front of it is the number that changes planning assumptions.
What the models did, and what they did not
Levcovich told SC Media the team worked with Anthropic's Claude Opus 4.7 and 4.8. A Security's own write-up is vaguer, referring to "publicly available frontier models" without naming them.
The more useful disclosure is the tooling. The team ran the models against an IDA Pro MCP plugin for reverse engineering and a Frida MCP server for dynamic tracing. This is the detail most coverage has skipped, and it is what explains the speed. The model was not reading a binary out of its own memory. It was issuing commands to a disassembler and a live instrumentation engine and reasoning over what came back.
The prompts published in the write-up read like direction rather than discovery: map the attack surface end to end, reverse the annotation protocol in IDA, audit the deserialisers for memory bugs, build the packet that reaches this function through normal parsing. A researcher who did not already know what to ask for would not have got there in a day, or possibly at all.
This does not deflate the result. It clarifies what collapsed: the weeks of manual reversing that used to separate a good hypothesis from a working proof.
The claim, weighed
A Security's conclusion is that "the barrier to producing this class of weapon has collapsed, and it won't come back". They also sell the capability they are describing, which is worth holding in view while reading their numbers.
The CVEs are real, Zoom credits Levcovich by name, and the disclosure dates in the write-up line up with Zoom's bulletins. The 24-hour figure and the prompt count rest on the vendor's own account and have not been independently reproduced.
Their broader framing deserves a narrower restatement. What got cheap was finding memory-safety bugs in an undocumented binary protocol and exploiting them on a target with weak mitigations. The macOS path worked because the process had neither pointer authentication nor a stack canary — a decade-old class of protection that this build did not have. A hardened target with a memory-safe parser is a different problem, and nothing here shows that one fell in a day.
The new part is the economics. A month of expert labour now compresses into an afternoon of a competent researcher's attention — on either side of the disclosure line.
The end-to-end encryption inversion
One detail deserves more attention than it has had. Zoom's server-side mitigation for CVE-2026-53415 did not initially apply to end-to-end encrypted meetings.
This is end-to-end encryption working as designed — a server that cannot read the traffic cannot filter it — but the consequence inverts the usual assumption. For a window, the meetings configured for the strongest privacy were the ones the vendor's emergency backstop could not reach, and they depended entirely on the client-side patch.
What to do
Update. Zoom Workplace 7.1.5 or 7.0.6 depending on your track, Zoom Rooms and the Meeting SDK on 7.1.5, and the VDI client and plugins on their own numbering. Take the exact versions from Zoom's bulletins rather than from any article, this one included, because the fixed version differs by product.
If you administer Zoom at scale, the annotation feature can be disabled by policy, along with file transfer and whiteboarding. That is attack-surface reduction rather than a fix, and it is worth doing on the reasoning that this is the second memory-safety finding in the same undocumented protocol.
The structural point is latency. Exposure begins when somebody finds the bug, not when the vendor hears about it, and finding them just got much cheaper. A patch cycle tuned to an era when this work took months is now tuned to the wrong number.
What to watch
Whether anyone reproduces a comparable result independently. One vendor's account of its own speed is a claim; two unrelated teams doing it is a change in the field.
Whether Zoom rewrites the annotation parser rather than patching it. Four findings in one proprietary protocol with no public specification suggests the specification is the problem.
And whether CVSS scoring adapts. A vector that files a genuine zero-click under "user interaction required" will keep mis-ranking this class of bug for every defender who triages by number.
View author profile → · Editorial policy
