Zoom Annotation Vulnerabilities Enable Hijacking of Meeting Participants

Three serious vulnerabilities in Zoom's annotation feature could have allowed meeting participants to hijack the computers of other attendees. The flaws, tracked as CVE-2026-53413 (CVSS 8.3), CVE-2026-53414 (CVSS 6.5), and CVE-2026-53415 (CVSS 8.3), affected the drawing and typing tools used on shared screens. Attackers needed nothing more than being present in the meeting—no clicks, downloads, or prompts were required from victims. Zoom patched the issues in client updates released in June and July, approximately two months before public disclosure, and no exploitation has been reported. None of the three identifiers currently appear in CISA's Known Exploited Vulnerabilities catalog.

The research came from "A Security," an Israeli-founded offensive-security startup that emerged from stealth in June with $37 million in funding. The firm reported going from initial discovery to a working exploit in under a day using fewer than 20 prompts on publicly available AI models—though no specific model was named, making independent verification impossible. A Security rates all three bugs at 9.0 under CVSS 4.0, higher than Zoom's own scoring, and credits one of the three to internal discovery by Zoom's team. The vendor has published no technical detail, so the writeup derives from A Security's reverse engineering.

Technical analysis revealed that Zoom annotations don't travel as images across the network. Instead, the client converts drawings into structured objects sent as count-data pairs, with receivers trusting the counts to determine buffer reads. CVE-2026-53413 involves a 128-byte buffer overflow caused by an unchecked count in the object's final field, where an oversized value overwrites the return address. CVE-2026-53414 is a buffer over-read, and CVE-2026-53415 is a use-after-free vulnerability. What made one malformed drawing reach every participant was a missing origin check: the dispatcher routes messages by type number without verifying the sender's seat. Type 0x10001 carries objects while 0x10002 signals acknowledgements—sending the first where the second belongs causes the victim's client to reconstruct the malicious object in full.

Affected versions include Zoom Workplace before 7.1.5 and 7.0.6, Zoom Workplace VDI Client for Windows before 7.0.11 and 6.6.16, and Zoom Rooms and Zoom Meeting SDK before 7.1.0 (7.1.5 for the third flaw). Organizations should verify they're running patched versions and audit their Zoom deployments. Security teams can validate their TLS configurations with an SSL/TLS checker and scan Zoom-related ports using a port scanner to confirm no unexpected services are exposed. Individual users concerned about meeting privacy should run a privacy checkup to review their overall exposure.