{"slug": "zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your", "title": "Zoomsday: A Zoom Zero-Click Vulnerability Let Any Meeting Guest Run Code on Your PC", "summary": "Zoom has patched a zero-click vulnerability, tracked as CVE-2026-53413 and dubbed 'Zoomsday' by security firm A Security, that allowed any meeting guest to execute code on another attendee's PC via the annotation toolbar. The flaw, rated high severity by Zoom's Trust and Security team, was part of a cluster of annotation issues covered by bulletins ZSB-26015 through ZSB-26018 published on 11 August, with fixes already available for desktop and mobile clients across Windows, macOS, Linux, iOS, and Android. Researchers from A Security exploited the bug in under 24 hours using fewer than 20 prompts with publicly available frontier AI models, highlighting how AI is accelerating reverse engineering.", "body_md": "*Four flaws in the annotation protocol, one working exploit, and fewer than 20 AI prompts between discovery and takeover.*\n\nZoom has patched a Zoom zero-click vulnerability that turned the annotation toolbar, of all things, into a remote code execution channel. Anyone sitting in a meeting where a screen was being shared could have taken control of another attendee’s machine. No click, no download, no permission dialog, and nothing on screen to hint that it had happened.\n\nThe headline bug is tracked as CVE-2026-53413. The team that found it, A Security, has named it “Zoomsday”, and Zoom’s own Trust and Security team rates it high severity. It is one of a cluster of annotation issues covered by bulletins ZSB-26015 through ZSB-26018, published on 11 August. Fixes are already out for the desktop and mobile clients across Windows, macOS, Linux, iOS and Android.\n\n## 128-byte buffers, 32-bit lengths\n\nAnnotation is the feature that lets people in a call scribble arrows, highlight a cell, or drop a text label on whatever is being shared. It does not go through the regular meeting media path. It rides a proprietary protocol that opens a direct channel between the presenter and every viewer, which is exactly what makes it interesting to attack.\n\nAccording to the writeup, the routine that unpacks text-annotation formatting data, **CAnnoFormatBlock::Deserialize**, works with several fixed-size 128-byte buffers while trusting 32-bit character counts that arrive straight off the wire. Declare a length that has nothing to do with the data you actually sent and the parser happily writes past the end of the buffer. That is a textbook overflow, in a code path that is live for every participant the moment a share begins.\n\nThere is no user interaction anywhere in that chain, which is what earns the zero-click label. The victim’s client is already listening. It just has to be handed a malformed block.\n\n## The AI angle is the uncomfortable part\n\nWhat makes this one worth paying attention to is not the bug class. Buffer overflows in binary parsers are as old as networked software. It is how quickly it went from a closed-source protocol nobody had publicly audited to a working exploit: the researchers say they used publicly available frontier models and got there in under 24 hours, with fewer than 20 prompts.\n\nThat number should be read carefully. It does not mean anyone can now point a chatbot at a random binary and get shells out of it. It does mean that the reverse-engineering grind that used to gate this kind of research, the part that took a skilled person a week of staring at disassembly, has gotten dramatically cheaper. Defenders have been told this was coming for a while. This is one of the cleaner public demonstrations of it.\n\n## What to actually do\n\nUpdate the client. Zoom pushes updates automatically for most consumer installs, but plenty of corporate deployments pin a version and roll it out on IT’s schedule, and those are precisely the environments where an outsider gets invited into a screen-share every day of the week. If you administer a fleet, check what build your users are actually running rather than what the policy says they should be.\n\nWorth remembering too that “a meeting participant” is a very wide net. Webinars, client calls, support sessions, recruitment interviews, anything with an open join link. The attacker did not need to be an admin, or the host, or even the one sharing their screen.\n\nSources: [The Hacker News](https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html) and [SecurityWeek](https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/).", "url": "https://wpnews.pro/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your", "canonical_source": "https://hwbusters.com/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your-pc/", "published_at": "2026-08-12 18:11:37+00:00", "updated_at": "2026-08-13 22:36:21.050178+00:00", "lang": "en", "topics": ["ai-research", "ai-tools"], "entities": ["Zoom", "A Security", "CVE-2026-53413", "ZSB-26015", "ZSB-26018", "The Hacker News", "SecurityWeek"], "alternates": {"html": "https://wpnews.pro/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your", "markdown": "https://wpnews.pro/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your.md", "text": "https://wpnews.pro/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your.txt", "jsonld": "https://wpnews.pro/news/zoomsday-a-zoom-zero-click-vulnerability-let-any-meeting-guest-run-code-on-your.jsonld"}}