{"slug": "update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on", "title": "Update Zoom: Two Annotation Flaws Could Let Meeting Participants Run Code on Other Devices", "summary": "Zoom Workplace users should update to version 7.1.5 or 7.0.6 to patch three annotation flaws that could let a meeting participant execute code on another participant's client, according to Zoom security bulletins published August 11, 2026. The vulnerabilities, tracked as CVE-2026-53413 (CVSS 8.3), CVE-2026-53414 (CVSS 6.5), and CVE-2026-53415 (CVSS 8.3), affect Zoom Workplace, Windows VDI client, Zoom Rooms, and Meeting SDK; two allow remote code execution and one is a denial-of-service issue. Security firm A Security claims AI helped produce an exploit in fewer than 20 prompts, but did not identify the models or provide an independently reproducible account.", "body_md": "# Update Zoom: Two Annotation Flaws Could Let Meeting Participants Run Code on Other Devices\n\n- Zoom Workplace users should update to version 7.1.5 or 7.0.6, depending on the release branch; VDI, Rooms and Meeting SDK users have separate fixed versions.\n[[1]](https://www.zoom.com/en/trust/security-bulletin/) - Zoom says CVE-2026-53413 and CVE-2026-53415 may allow a meeting participant to execute code on another participant’s client. CVE-2026-53414 is described as a denial-of-service flaw.\n[[2]](https://www.zoom.com/en/trust/security-bulletin/zsb-26017/) - Zoom assigns CVSS scores of 8.3, 6.5 and 8.3. A Security describes the vulnerabilities more severely under a different scoring framework.\n[[3]](https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html) - A Security says AI helped produce the exploit in fewer than 20 prompts, but it did not identify the models or provide an independently reproducible account of the claim.\n[[4]](https://a.security/blog/asecurity-zoomsday)\n\nZoom users should update the application before joining further meetings. Three vulnerabilities in the platform’s annotation functionality could let a meeting participant affect another participant’s client, according to Zoom security bulletins published August 11, 2026. Two of the flaws may enable remote code execution; the third is described by Zoom as a denial-of-service issue. [[1]](https://www.zoom.com/en/trust/security-bulletin/)\n\nThe affected products include Zoom Workplace on all supported platforms, the Windows VDI client, Zoom Rooms and the Zoom Meeting SDK. Zoom lists fixed versions of 7.1.5 and 7.0.6 for Workplace, 7.0.11 and 6.6.16 for the Windows VDI client, and 7.1.0 or 7.1.5 for Rooms and the SDK, depending on the vulnerability. [[2]](https://www.zoom.com/en/trust/security-bulletin/zsb-26017/)\n\n## What users need to do\n\nOrganizations should use Zoom’s download channel or endpoint-management tools to verify that clients meet the fixed-version requirements. Zoom’s public bulletins direct users to install the latest available updates. [[1]](https://www.zoom.com/en/trust/security-bulletin/)\n\nA Security says Zoom shipped an initial client-side fix in version 7.1.0 on June 22, followed by a server-side mitigation on July 15 and a later client fix in version 7.1.5 on July 20. Those dates and the interim mitigation come from the researcher’s disclosure timeline, not from the public Zoom bulletins. [[5]](https://a.security/blog/asecurity-zoomsday)\n\nA Security advises disabling end-to-end encryption on older clients until they can be updated, arguing that server-side filtering cannot inspect encrypted meeting traffic. That is an interim measure described by the reporting firm, not a substitute for patching. [[5]](https://a.security/blog/asecurity-zoomsday)\n\nAdministrators can also reduce exposure by requiring authenticated participants, using waiting rooms and limiting access to meeting links. Those measures restrict who can enter a meeting but do not repair a vulnerable client. [[5]](https://a.security/blog/asecurity-zoomsday)\n\n## The flaws sit in annotation processing\n\nZoom tracks the issues as CVE-2026-53413, a buffer overwrite with a CVSS score of 8.3; CVE-2026-53414, a buffer over-read scored 6.5; and CVE-2026-53415, a use-after-free scored 8.3. Zoom says the overwrite and use-after-free may allow a participant to achieve remote code execution on another participant’s client through network access. It describes the over-read as potentially enabling denial of service. [[6]](https://www.zoom.com/en/trust/security-bulletin/zsb-26015/)\n\nA Security’s technical write-up says annotation data is sent as structured objects rather than as a simple image. The receiving client reconstructs those objects from fields controlled by the sender. The researchers say missing bounds checks in that process caused memory-corruption conditions, while a separate parsing flaw could expose uninitialized memory. [[5]](https://a.security/blog/asecurity-zoomsday)\n\nThe reported attack required the target to be present in the meeting, but no click, download or confirmation prompt, according to an independent account from The Hacker News. Zoom has not published enough technical detail to independently reproduce the researchers’ full attack chain. [[7]](https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html)\n\n## AI-assisted research claim remains unverified\n\nA Security says it identified the first vulnerability on June 8, confirmed a working exploit the next day and reported the issue to Zoom on June 10. The firm says an AI agent and publicly available models helped move from discovery to exploitation in fewer than 20 prompts and less than 24 hours. [[5]](https://a.security/blog/asecurity-zoomsday)\n\nThe claim is notable because the research targeted closed-source software and an undocumented communications protocol. But A Security’s own account says its first automated pass ranked 3,762 functions across 70 libraries and missed the vulnerable annotation library. Researchers found the relevant code only after tracing the client during a live meeting. [5] That makes the result more accurately described as AI-assisted research rather than an independently operating AI system finding and weaponizing the flaw.\n\nThe company did not identify the models or release a full prompt history, so outsiders cannot determine how much of the result came from the models, the researchers’ reverse engineering or existing tooling. The Hacker News also reported a severity dispute: Zoom’s vendor-assigned scores are lower than A Security’s public description of the flaws as critical. [[7]](https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html)\n\nNo exploitation in the wild had been reported as of the August 11 disclosure, and The Hacker News reported that the CVEs were not listed in CISA’s Known Exploited Vulnerabilities catalog at that time. [7] The immediate risk therefore remains concentrated in unpatched clients, with version verification the clearest defensive action.\n\n## Companies mentioned\n\n## Further sources\n\n[[1] Zoom’s security bulletin index directs users to update and identifies the affec… ↗](https://www.zoom.com/en/trust/security-bulletin/)\n\n[[2] Zoom’s individual bulletins describe the affected products, fixed versions and … ↗](https://www.zoom.com/en/trust/security-bulletin/zsb-26017/)\n\n[[3] Zoom assigns CVSS scores of 8.3, 6.5 and 8.3; independent reporting describes A… ↗](https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html)\n\n[[4] A Security says it used publicly available AI models and fewer than 20 prompts … ↗](https://a.security/blog/asecurity-zoomsday)\n\n[[5] A Security’s disclosure describes the discovery timeline, AI-assisted workflow,… ↗](https://a.security/blog/asecurity-zoomsday)\n\n[[6] Zoom’s bulletins identify CVE-2026-53413 as a buffer overwrite, CVE-2026-53414 … ↗](https://www.zoom.com/en/trust/security-bulletin/zsb-26015/)+1 more\n\nThe stories that matter, in one email. Free — unsubscribe anytime.", "url": "https://wpnews.pro/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on", "canonical_source": "https://mlq.ai/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on-other-devices/", "published_at": "2026-08-14 11:05:40.852131+00:00", "updated_at": "2026-08-14 11:05:43.632764+00:00", "lang": "en", "topics": ["ai-ethics"], "entities": ["Zoom", "Zoom Workplace", "Zoom Rooms", "Zoom Meeting SDK", "A Security", "CVE-2026-53413", "CVE-2026-53414", "CVE-2026-53415"], "alternates": {"html": "https://wpnews.pro/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on", "markdown": "https://wpnews.pro/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on.md", "text": "https://wpnews.pro/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on.txt", "jsonld": "https://wpnews.pro/news/update-zoom-two-annotation-flaws-could-let-meeting-participants-run-code-on.jsonld"}}