Zoom fixed a critical bug that let a stranger in your meeting silently take over your laptop or phone, and researchers built the exploit using nothing but public AI models in under 24 hours.
On August 11, 2026, Zoom pushed out patches for four vulnerabilities in its video conferencing software, and the worst one has a name that sounds like a horror movie for a reason. CVE-2026-53413, nicknamed "Zoomsday" by the research team that found it, let any participant in a Zoom meeting take over every other participant's device, Windows, macOS, Linux, iOS, Android, all of it, without that person clicking anything, approving anything, or seeing a single warning on screen.
You don't need to open a file. You don't need to click a link. You just need to be in the same meeting as the attacker.
The flaw lived in Zoom's screen annotation feature, the tool people use to draw arrows and circles on a shared screen during a call. According to research published by A Security, the team credited with the discovery, the bug traces back to a routine called CAnnoFormatBlock::Deserialize, which parses annotation formatting data sent between clients. That routine holds several fixed-size 128-byte buffers but trusts the 32-bit character counts an attacker sends over the network without checking them. No bounds check, no warning, nothing. Send a crafted annotation message with an inflated count, and you overflow the buffer and start overwriting adjacent memory on the victim's machine. Zoom's own security team rated it high severity with a CVSS score of 8.3, while the researchers who found it call it critical, and after reading how it works, it's hard to argue with them.
Two related bugs shipped in the same disclosure. CVE-2026-53414 is a buffer overread in the same annotator that can be used to crash a participant's client outright, a denial-of-service play rather than a takeover. CVE-2026-53415 is a use-after-free issue in the same component. Zoom's patch notes point users toward Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Zoom Meeting SDK 7.1.5, and if you run any of those, update now, not after your next meeting.
Built in a day, with an AI doing the work #
Here's the part that should worry every security team, not just Zoom's. A Security says it built a working exploit chain for Zoomsday in under 24 hours using fewer than 20 prompts to publicly available AI models. No months of manual reverse-engineering. No elite team quietly poring over disassembled binaries for a quarter. One researcher, a laptop, and an AI model doing the heavy lifting on a bug class that, as the researchers themselves noted, used to require nation-state resources and nation-state patience.
What this means for the rest of us #
That's the actual story here, and it's bigger than Zoom. Frankly, the software itself getting patched is the routine part. Zoom has fixed serious bugs before and will again. What's new is the cost curve. If finding and weaponizing a zero-click RCE in ubiquitous business software now takes a day and twenty prompts instead of a team and a season, then every company running video calls, shared documents, or any protocol that parses attacker-controlled data in real time needs to assume its own zero-days are closer to being found than they were a year ago.
For startups, the exposure is direct. Board meetings, investor calls, product demos with unreleased code on screen: all of it runs through Zoom or something like it every day. Almost none of it gets the security scrutiny a company gives its own codebase. A zero-click bug that needs no user interaction and shows no warning is exactly the kind of thing a founder never notices until it's too late. As SecurityWeek and Security Affairs both reported following Zoom's disclosure, the annotation feature at the center of Zoomsday ships by default across Zoom's desktop and mobile clients, meaning the exposed surface was effectively every active Zoom user until the patch landed. Zoom hasn't said whether Zoomsday was exploited outside the research lab before the fix shipped. That's the honest, unresolved part of this story. It's worth sitting with, not smoothing over with reassurance the company hasn't actually given.
Also read: India's Power Grid May Not Be Ready to Fuel the AI Data Center Boom • YMTC Overtook Kioxia in NAND Flash Shipments for the First Time • Investors Are Already Pricing Anthropic As A $2 Trillion Company