Zoom has released fixes for three memory corruption vulnerabilities in its annotation feature, a collection of flaws that allowed any participant on a call to execute code on another attendee's device without any interaction. The patches were shipped in June and July 2026, roughly two months before the research became public, meaning users on current clients are already protected.

The vulnerabilities affect the annotation tools used during screen sharing. A malicious participant, whether host or guest, could send specially crafted annotation messages that run arbitrary code on other machines in the call. No click was required, and there was no visible indication that anything had gone wrong.

Zoom has documented the issues under CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. The company rates the first and third at 8.3 on the CVSS scale and the middle one at 6.5. A Security, the security firm that discovered the flaws, assigned all three a severity score of 9.0 out of 10, reflecting the lack of user interaction and network-based attack vector.

Affected products and fixed builds

Organizations and individual users need to verify they are running the corrected versions. The fixed builds are Zoom Workplace 7.1.5 and 7.0.6, Rooms and the Meeting SDK at 7.1.5, and the Windows VDI client at 7.0.11 and 6.6.16. Anything older remains exposed.

For most users, the client will update automatically, but administrators should confirm deployment in managed environments. The patches are cumulative, so upgrading to the minimum fixed version should close all three vulnerabilities.

What the vulnerabilities look like

The underlying failures are ordinary memory-safety issues rather than exotic design flaws. Annotation messages cross the network as a sequence of counts followed by data. The receiving client trusted the counts supplied by the sender. In one case, an attacker could supply a value that overran a fixed 128-byte buffer, corrupting a return address and hijacking execution flow.

A second flaw involved the dispatcher accepting annotation messages without checking which participant had sent them. This removed a natural boundary: an attacker could send messages from a context that should not have been allowed, making the vulnerability easier to reach.

After successful exploitation, an attacker gains the privileges of the Zoom client running on the target device. That opens the usual menu of post-exploitation actions: file theft, camera and microphone access, credential and wallet harvesting, and deployment of second-stage payloads. Because the attack happens silently during a call, the victim may have no reason to suspect that their machine has been compromised.

Severity and public reporting

The timing of the disclosure is important. The story has been described in some coverage as an emergency patch, but the reality is more measured. Zoom closed the holes roughly two months before the research went public. Users on a current client are already covered, and the remaining risk is concentrated in systems that are not updated.

The severity scoring differences are also notable. A Security, the firm that found the bugs, placed all three at 9.0, while Zoom rates CVE-2026-53413 and CVE-2026-53415 at 8.3 and CVE-2026-53414 at 6.5. Score differences of this kind are common because vendors and researchers weigh factors such as exploitability, attack complexity, and business impact differently. Zoom's lower score for the middle vulnerability may reflect the fact that it requires the other two bugs to be chained, or that it is not directly memory corruption.

What is not in dispute is that the attack surface is real. Any participant in a call, including someone who joined as a guest, can interact with annotation tools during screen sharing. If an attacker can join a meeting with a malicious identity, they can attempt to trigger the flaws.

AI and the evolving exploit pipeline

The most visible angle in the disclosure is the claim that artificial intelligence did the heavy lifting. A Security says it went from the initial findings to a working exploit in under a day, using fewer than 20 prompts on publicly available AI models. The firm argues that this level of speed was until recently the preserve of nation-state intelligence agencies or highly specialized exploit developers.

OpenAI has also moved in this direction, shipping a cyber model trained to refuse less, intended for defensive work but also capable of assisting with vulnerability research. The availability of large language models that can reason over source code has lowered the barrier to entry for finding and exploiting memory corruption bugs.

However, the full story complicates the AI narrative. An automated ranking pass over 3,762 functions missed the vulnerable library entirely, placing it 45th. The bug only surfaced when a researcher traced a live call by hand. AI was able to weaponize the flaw quickly, but a human was needed to find it. This is a useful corrective for the idea that autonomous AI systems are already discovering novel vulnerability classes at scale.

The broader vulnerability landscape

The shift toward AI-assisted vulnerability discovery is real regardless of the details of this case. Anthropic's Mythos model has reportedly found 10,000 critical vulnerabilities in a month, a volume that far outpaces the industry's ability to patch them.

This creates a dangerous asymmetry. Attackers can use AI to discover and exploit bugs faster than vendors can triage and release fixes. Defenders need to close the gap with faster patch cadence, better detection, and more widespread use of memory-safe languages in new code.

For Zoom users, the immediate action is straightforward: update to a fixed build. The long-term lesson is broader. Network-exposed applications that parse untrusted data must treat every field as hostile. Counts, lengths, and indices are all potential sources of memory corruption when they control buffer operations.

The annotation feature is a useful reminder that collaboration tools are an increasingly common attack surface. Screen sharing, chat, reactions, and annotations all require parsing untrusted input from other participants. As remote work and hybrid meetings remain central to business operations, the security of these features deserves the same attention as authentication and encryption.

Zoom's response appears to have been prompt, but the company has not yet revealed whether it has made changes to its annotation implementation beyond the specific patches. Future updates may include additional hardening, such as bounds-checked data structures and sender authentication for all annotation messages.

For now, enterprises should inventory their Zoom installations, identify devices running older builds, and upgrade to the fixed versions. The absence of a user interaction requirement makes these bugs especially valuable to attackers, but the two-month patch window before disclosure gives administrators time to protect their fleets if they act quickly.

The episode also reinforces the importance of defense in depth. Even with patched clients, endpoint detection and response tools should be configured to watch for abnormal behavior originating from collaboration applications. It only takes one unpatched device in a meeting to become a trusted pivot point into a broader corporate network.

Source: TNW | Apps News