A meeting, and that's enough

Sharing your screen on Zoom, or simply watching someone do it, could have sufficed to take control of another person's computer. Three vulnerabilities targeting the annotation tool — that function that allows drawing and writing on a shared screen — have just been made public, while patches have been circulating since June and July. The victim had nothing to do other than be present in the meeting: no clicks, no downloads, no prompts, nor the slightest visible sign on the screen.

Zoom released bulletins ZSB-26015, ZSB-26016, and ZSB-26017 on August 11, 2026, covering three distinct vulnerabilities in the "annotator" function of its clients:

CVE Type Zoom CVSS CWE Bulletin Credit
CVE-2026-53413 Buffer over-write 8.3 (High) CWE-787 ZSB-26015 Idan Levcovich, A Security
CVE-2026-53414 Buffer over-read 6.5 (Medium) CWE-126 ZSB-26016 Idan Levcovich, A Security
CVE-2026-53415 Use-after-free 8.3 (High) CWE-416 ZSB-26017 Zoom Offensive Security

According to the official descriptions, all three allow "a participant to achieve remote code execution on another participant via network access" (for the two most severe) or to cause a denial of service (for the buffer over-read).

Who is affected and which versions to apply

The Zoom bulletins list a wide scope — all supported platforms (Windows, macOS, Linux, iOS, Android), as confirmed by the NVD database:

  • Zoom Workplace (all platforms): before 7.1.5 and 7.0.6 in their respective branches;
  • Zoom Workplace VDI Client for Windows: before 7.0.11 and 6.6.16;
  • Zoom Rooms (all platforms): before 7.1.0 (and 7.1.5 for the use-after-free vulnerability);
  • Zoom Meeting SDK (all platforms): before 7.1.0 (and 7.1.5 for the third vulnerability).

Note: On the same day, Zoom published a fourth bulletin, ZSB-26018 (CVE-2026-53416, High), concerning a path traversal vulnerability in the VDI client. This is a separate issue, but it illustrates a wave of patches concentrated on the same day.

The patches are not recent: they were delivered in June and July, nearly two months before the public disclosure, and no active exploitation has been reported by the time of publication. None of the three identifiers appear in the CISA Known Exploited Vulnerabilities catalog, whose SSVC analysis (published simultaneously on August 11) concludes with an exploitation rating of "none" and an automation rating of "no," while classifying the technical impact as "total" for the two code execution vulnerabilities.

The mechanism, as reconstructed by researchers

Zoom has not published technical details; the inner workings come from the reverse engineering of the startup A Security, a young Israeli offensive security firm that went public in June with $37 million in funding.

The central point: a drawing does not traverse the network like an image. The client transforms it into a structured object, sent as a series of counters followed by data, and the receiver trusts these counters to decide how much to read. One of them fills a fixed buffer of 128 bytes without checking that the data fits — and since it is the last field of the object, an oversized count overflows and overwrites the return address. This is the essence of CVE-2026-53413.

What allows a malformed drawing to reach the entire room is a missing check on the message's origin. Each viewer maintains a channel to the sharer, and the sharer has one back meant to carry acknowledgments. In the paths traced by researchers, the dispatcher reads the message type number on the network and passes it to the corresponding parser without asking which seat the sender occupied. 0x10001 means "here's an object"; 0x10002 means "I've received yours." Sending the first where the second is expected, and the victim's client reconstructs the object entirely.

Two diverging readings

The accounts from Zoom and A Security diverge on several points, and this is precisely what makes cross-reading useful.

On severity. A Security rates the three vulnerabilities at 9.0 under CVSS 4.0, a score that appears in none of Zoom's bulletins. The latter, which now issues its own CVE records as the NIST no longer re-scores systematically, holds 8.3 / 8.3 / 6.5 under CVSS 3.1. These lower numbers will likely remain the official figures.

On the "zero-click." Zoom's vectors mark user interaction as required (UI:R), which does not align well with the "zero-click" framing highlighted by the researchers. The nuance: the victim must "be in the meeting," but no action on their part is necessary to trigger the exploit.

On the buffer over-read (CVE-2026-53414). This is where the gap is clearest. A Security claims to have recovered uninitialized heap memory from a victim's client, containing live code and vtable pointers — the very material needed for an ASLR (Address Space Layout Randomization) bypass. The official bulletin, however, indicates that the same vulnerability may allow for a "denial of service" and notes a zero impact on confidentiality. Thus, the researcher's reading sees it as a potential link in an exploit chain; Zoom's sees it as a simple crash.

On credit. The attribution is unclear as well. Two bulletins (ZSB-26015, ZSB-26016) credit Idan Levcovich from A Security. The third (ZSB-26017, use-after-free) credits Zoom Offensive Security, the internal team already responsible for the 9.8-rated code execution vulnerability patched in July. A Security, however, claims credit for all three while acknowledging that Zoom "already knew" about the third and had filtered it server-side before reporting it.

AI at the heart of the story — and its limitations

The most striking element of the disclosure lies in the method. A Security claims to have moved from discovering the vulnerability to a functional exploit in less than a day, with less than 20 requests on "publicly available" AI models — without naming the model used, which makes the claim unverifiable.

The internal narrative is actually more tangled than the summary. An initial automated pass, classifying the functions reachable from the Java layer, produced a queue of 3,762 functions spread across 70 libraries and missed the vulnerable library, ranking it 45th. It only emerged when the researchers traced the running client through an actual call, feature by feature. The triumph of AI is thus also the story of an automation failure corrected by manual analysis.

The timing is significant: the disclosure comes a day after OpenAI split its Daybreak program and released GPT-5.6-Cyber only to controlled partners, on the grounds that this capability must be regulated. According to OpenAI's own metrics, its public model under safeguards only responds to 1.5% of advanced offensive security requests, versus 95% for the restricted version. A Security maintains that it achieved its result using models accessible to everyone. Idan Levcovich soberly concludes that the barrier to building this class of exploits "has collapsed, and it will not return."

What to do

The course of action is straightforward:

  1. Update all Zoom clients (Workplace, VDI, Rooms, Meeting SDK) to the patched versions listed above, prioritizing Windows VDI endpoints and exposed meeting rooms.
  2. Ensure that auto-update is enabled on the Zoom side and that VDI deployments, often slower to update, are not lagging behind on version 6.6.x.
  3. Consider that meetings with screen sharing and annotation open to external parties (webinars, support sessions, public events) represent the most exposed attack surface: restrict annotator roles to organizers where possible.
  4. Monitor the list of Zoom bulletins — a fourth vulnerability (ZSB-26018, path traversal VDI) published on the same day suggests a wave of fixes to follow.

The scenario — a malicious participant taking control of another via a simple drawing — illustrates how real-time collaboration functions, designed for fluidity, rely on implicit trust in the data that transits between clients. For now, and because the patches preceded publicity, the risk remains theoretical. The ease described by the researchers, however, is no longer theoretical.