“Zoomsday” flaws could let one Zoom participant attack another

1. Executive summary

Three memory-safety vulnerabilities in the Zoom annotation parser — CVE-2026-53413 (CVSS 8.3 HIGH, CWE-787 out-of-bounds write), CVE-2026-53414 (CVSS 6.5 MEDIUM, CWE-126), and CVE-2026-53415 (CVSS 8.3 HIGH, CWE-416 use-after-free) — could allow a malicious meeting participant to crash, leak memory from, or execute arbitrary code on another participant's client via crafted annotation data. None of the CVEs are currently listed in CISA's KEV catalogue and EPSS scores are 0%, indicating no observed wild exploitation at time of writing. The attack requires the adversary to be present in the same meeting as the victim but, per the researchers, demands no additional victim interaction beyond being in the session. EMEA financial services firms deploying Zoom for client calls, internal collaboration, or VDI-based trading-floor communications should treat this as a high-priority patch and configuration-hardening task.

2. Regulatory framing

3. Technical analysis & attack chain

Affected products and fixed versions (single-sourced: Malwarebytes; verify against Zoom's security bulletin before enforcement)

Vulnerability details (per VERIFIED REFERENCE DATA)

Severity discrepancy: The researchers rated all three flaws as Critical, while Zoom rated them as High. The verified CVSS scores (8.3, 6.5, 8.3) align with Zoom's High classification. The discrepancy stems from whether successful exploitation requires user interaction: Zoom scores under the assumption that the attacker must persuade the target to join a meeting (user interaction), while the researchers argue that once a victim is in the meeting, no further interaction — no click, no download, no prompt — is needed for the annotation payload to fire.

Confirmed attack chain

1. Meeting access. The attacker obtains entry to the same Zoom meeting as the victim. Vectors include joining an open/public meeting, abusing a leaked meeting link, posing as an expected attendee, or compromising an account that already has access.
2. Annotation data transmission. The attacker sends crafted structured annotation data (the data representing a drawing, text box, or other annotation object) to the meeting session. The victim's Zoom client receives this data as part of normal meeting collaboration traffic.
3. Parser exploitation. The victim's client passes the malicious data to the annotation parser, which fails to properly validate lengths, counts, and references before use. Depending on the CVE triggered: - CVE-2026-53413: an out-of-bounds write corrupts memory. - CVE-2026-53414: a buffer over-read leaks memory contents. - CVE-2026-53415: a use-after-free condition allows controlled memory reuse.
4. Impact. The vulnerable client crashes, leaks information, or executes attacker-controlled code. Per The Hacker News reporting, screen-sharing participants could have taken over the computers of all viewers, and viewers could have taken over the presenter's machine — with nothing on screen to indicate exploitation.

Unconfirmed claims: No named threat actor is associated with these vulnerabilities; attribution is unconfirmed. No CISA-KEV remediation due-date exists. No IOCs, malware families, or post-exploitation tooling have been published. The detailed technical write-up (memory layouts, specific parser functions, proof-of-concept payloads) was not available in the provided source material.

4. Mitigation & containment

P1 — Within 24 hours

• Inventory and patch. Identify all Zoom client deployments across the estate — Zoom Workplace (desktop), Zoom Workplace VDI Client (Windows), Zoom Rooms, and any applications embedding the Zoom Meeting SDK. Update to the fixed versions: Zoom Workplace ≥ 7.1.5 (or ≥ 7.0.6 on the 7.0.x branch); VDI Client ≥ 7.0.11 (or ≥ 6.6.16 on the 6.6.x branch); Zoom Rooms ≥ 7.1.5; Meeting SDK ≥ 7.1.5. Verify via MDM, VDI management console, and SDK supplier attestation.
• Disable annotation for sensitive meetings. In Zoom admin settings, disable annotation, whiteboards, and remote control for meetings that do not require them — particularly external-facing calls, large town-halls, and any meeting with open invitations. This removes the attack surface entirely while patching proceeds.

P2 — Within 72 hours

• Enforce meeting access controls. Require passcodes, enable waiting rooms, restrict meetings to authenticated users, and use unique meeting links for sensitive calls. This raises the cost of achieving the first attack-chain step (meeting access).
• Disable additional high-risk collaboration features where not needed: file transfer, third-party apps, and screen-share annotation for participants who only need to view.
• VDI-specific review. For trading-floor and remote-worker VDI environments running Zoom Workplace VDI Client, confirm the thin-client image and persistent disk layers are updated to 7.0.11 or 6.6.16. VDI clients are frequently missed by standard MDM patch cycles.

P3 — Within 7 days

• Audit SDK integrations. Identify all in-house and third-party applications that embed the Zoom Meeting SDK. Require suppliers to confirm SDK version ≥ 7.1.5. For in-house integrations, rebuild against the patched SDK and republish.
• Monitor for anomalous meeting crashes. Per the source guidance, a single crashed meeting is not proof of attack, but repeated crashes involving the same participant or meeting ID warrant investigation. Review Zoom dashboard logs and endpoint EDR for process termination patterns in the Zoom client executable.
• Verify MDM update delivery. Confirm that device-management tools are successfully pushing the updated Zoom client to every deployed endpoint, including remote and BYOD devices.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material describes the vulnerability mechanism and behavioural patterns but provides no threat artefacts — no file hashes, distinctive strings, mutex names, command-line flags, scheduled-task names, file paths, or registry keys associated with exploitation. CVE identifiers and product names are not threat artefacts and cannot be used to build functional YARA or Sigma rules.

Recommended EDR/SIEM detection approach (derived from source guidance, not a rule): Monitor for abnormal termination of the Zoom client process (e.g., Zoom.exe on Windows) correlated with active screen-share or annotation sessions, particularly when the crash is preceded by annotation data from a specific participant. Alert on any child process spawned by the Zoom client executable that is not part of normal Zoom operation (e.g., cmd.exe, powershell.exe, rundll32.exe).

CVE assessment

3 referenced CVEs

7. Sources

• Malwarebytes — "Zoomsday" flaws could let one Zoom participant attack another — https://www.malwarebytes.com/blog/bugs/2026/08/zoomsday-flaws-could-let-one-zoom-participant-attack-another — 2026-08-12
• The Hacker News — Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client — https://thehackernews.com/2026/08/zoom-annotation-flaws-could-let-meeting.html — 2026-08
• The Hacker News — Zoom Patches Critical Windows Flaw That Could Enable Account Takeover (context: CVE-2026-53412, separate vulnerability) — https://thehackernews.com/2026/07/zoom-patches-critical-windows-flaw-that.html — 2026-07

8. Adverse Trace position

The "Zoomsday" annotation-parser flaws represent a credible client-side execution risk for any organisation using unpatched Zoom clients. The verified CVSS scores of 8.3 HIGH (CVE-2026-53413, CVE-2026-53415) and 6.5 MEDIUM (CVE-2026-53414) are authoritative; the researchers' Critical rating reflects a scoring disagreement over user interaction, not a factual error — both perspectives are defensible. The attack vector is distinctive: exploitation requires meeting presence but no post-join victim interaction, making waiting-room and authentication controls meaningful mitigations alongside patching. No wild exploitation is observed (EPSS 0%, not in CISA KEV), and attribution is unconfirmed. For EMEA financial services, the priority is patching all client variants — including VDI and embedded SDK instances — and disabling annotation on sensitive calls until the estate is confirmed current. We will monitor for KEV addition, proof-of-concept publication, and any indication of active exploitation.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.