Zero-Click Zoom Flaw Hands Over the Room

Zoom's annotation tool, the feature that lets participants draw on a shared screen, harbored a trio of flaws that could let a meeting participant hijack another attendee's client. The vulnerabilities, disclosed by the offensive-security startup A Security, required no action from the victim — no click, no download, no prompt, and nothing on screen to indicate compromise.

A silent takeover

According to A Security, the flaws could enable two attack scenarios: anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's machine. The attack demanded nothing beyond the victim being in the meeting.

The bugs live in the annotation tool, which converts drawings into structured objects sent over the network. A malicious participant could craft a malformed drawing that, when processed by the receiver's client, triggers memory corruption.

Patches predate disclosure

Zoom shipped fixes in June and July, roughly two months before the flaws were made public, and no exploitation has been reported as of publication. None of the three identifiers appear in the CISA Known Exploited Vulnerabilities catalog.

The patched versions include Zoom Workplace, all supported platforms, before 7.1.5 and 7.0.6; Zoom Workplace VDI Client for Windows, before 7.0.11 and 6.6.16; and Zoom Rooms and Zoom Meeting SDK, all platforms, before 7.1.0, and before 7.1.5 for the third flaw.

Under the hood

Zoom has published no technical detail, so the internals come from A Security's own reverse engineering. A drawing does not cross the network as a picture; the client turns it into a structured object and sends it as a run of counts followed by data, and the receiver trusts those counts to decide how much to read.

One of the flaws fills a fixed 128-byte buffer with no check that the data fits. Because it is the object's last field, an oversized count runs past the end and over the return address, enabling code execution.

What makes one malformed drawing reach the whole room is a missing check on where a message came from. Every viewer holds a channel to whoever is sharing, and the sharer holds one back that is meant to carry acknowledgements. The dispatcher reads a message's type number off the wire and hands it to the matching parser without asking which seat the sender occupied. 0x10001 means here is an object; 0x10002 means I received yours. Send the first where the second belongs, and the victim's client rebuilds the object in full.

Scoring dispute

Zoom tracks the flaws as CVE-2026-53413 (CVSS score: 8.3), a buffer over-write, and CVE-2026-53414 (CVSS score: 6.5), a buffer over-read, both covered by ZSB-26015 and ZSB-26016, plus CVE-2026-53415 (CVSS score: 8.3), a use-after-free, in ZSB-26017. The firm puts all three at 9.0 under CVSS 4.0, a score that appears in none of the bulletins. Zoom issues its own CVE records, and NIST no longer routinely re-scores them, so the lower figures will likely stand.

All three vendor vectors mark user interaction as required, which sits badly beside the zero-click framing. The startup's analysis argues the attacks are truly zero-click because they require no interaction from the victim — merely being in the meeting.

A.I. in the loop

A Security says it went from finding the flaw to a working exploit in under a day, using fewer than 20 prompts on publicly available AI models. The writeup names no model, so the claim is unverifiable, but the firm's account of the AI work is messier than its own summary.

The first pass, an automated ranking of functions reachable from the Java layer, produced a queue of 3,762 functions across 70 libraries and missed the vulnerable library completely, ranking it 45th. It surfaced only when they traced the running client through a live call, feature by feature.

Credit and context

The two accounts diverge on attribution. Zoom credits one of the three to its own internal team, while A Security lists all three as its own. The startup acknowledges that Zoom already knew about the use-after-free and had filtered it server-side before the report arrived.

The disclosure follows OpenAI splitting its Daybreak program a day earlier and releasing GPT-5.6-Cyber to vetted partners only, on the argument that this capability needs gating. The startup says it got its result from models anyone can use. By OpenAI's own measure, its guardrailed public model answers 1.5% of advanced offensive-security prompts, against 95% for the restricted one.

Why it matters

These flaws could allow a participant to take over the presenter's machine, or the presenter to take over the entire room, in a zero-click attack on a widely used platform. The lack of exploitation so far is a relief, but the patches' existence means the details are now public, and the window for attackers to reverse-engineer the fixes is open.

As A Security's Levcovich writes, the barrier to building this class of exploit "has collapsed, and it will not come back." That suggests the era when memory-corruption attacks required deep manual expertise may be ending, and automated tools can now do the heavy lifting.