Ethical Hacking News
Zoom has patched a critical zero-click flaw that could allow a meeting participant to execute code on another user's computer without any user interaction, dubbed "Zoomsday". This vulnerability affects all supported platforms and can be exploited through Zoom's normal encrypted transport. Zoom has released security updates to address the issue.
Zoomsday is a zero-click flaw discovered by security researcher A Security that exposes a critical vulnerability in Zoom's annotation feature. The flaw allows a meeting participant to execute code on another user's computer without any user interaction, affecting all supported platforms. Zoom has released security updates for affected platforms, including Windows, Mac, iPhone, Android, and Linux. The vulnerability can be exploited to steal data, activate cameras or microphones, install malware, and cause a denial-of-service (DoS) attack. Regular security updates and vulnerability assessments are crucial in protecting against cyber threats like Zoomsday.
Zoomsday, a zero-click flaw discovered by security researcher A Security, has exposed a critical vulnerability in Zoom's annotation feature that allows a meeting participant to execute code on another user's computer without any user interaction. This flaw has been dubbed "Zoomsday" and affects all supported platforms, including Windows, Mac, iPhone, Android, and Linux.
The vulnerability exists in every version of Zoom up to and including 7.0.5 and can corrupt memory through a specially crafted message. Attackers could exploit this flaw to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware. In large meetings, a single malicious message could expose multiple participants at once.
Zoom's Android client was chosen as the primary target due to its closed-source nature, wide deployment, and exposed native-code attack surface. Researchers first identified 3,762 functions across 70 libraries but found that the JNI-focused approach missed remotely reachable code. Dynamic tracing instead identified libannotate.so and its proprietary annotation protocol as the source of the flaw.
Reverse engineering revealed that annotation objects are serialized and rebuilt from attacker-controlled network data without adequate origin checks. This allowed researchers to discover CVE-2026-53413, a remotely triggerable stack buffer overflow in CAnnoFormatBlock::Deserialize. A wire-controlled count can exceed fixed 128-byte buffers, allowing data to overwrite adjacent memory.
The flaw can be reached through Zoom's normal encrypted transport, requiring no victim interaction or instrumentation. A Security also found CVE-2026-53414, a missing bounds check in Zoom's annotator that can cause a buffer overread and crash a meeting participant's client, enabling DoS attacks. It also identified CVE-2026-53415, a use-after-free flaw, but Zoom had already discovered the issue before A Security reported it.
In response to this vulnerability, Zoom has released security updates for all supported platforms, including Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5. These updates address the above vulnerabilities and are available for download.
The discovery of this zero-click flaw highlights the importance of regular security updates and vulnerability assessments in protecting against cyber threats. It also emphasizes the need for businesses and individuals to prioritize cybersecurity measures to prevent similar vulnerabilities from occurring in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/Zoomsday-A-Zero-Click-Flaw-Exposes-Remote-Code-Execution-Vulnerability-ehn.shtml
https://securityaffairs.com/197042/hacking/zoom-patches-zoomsday-zero-click-flaw-enabling-remote-code-execution.html
Published: Tue Aug 11 13:28:06 2026 by llama3.2 3B Q4_K_M
