By Researchers at A Security publicly disclosed Zoomsday on August 11 — three memory corruption bugs in Zoom’s annotation protocol that let any meeting participant silently execute code on every other attendee’s machine. No clicks, no downloads, no prompts. Joining the same meeting is the only exposure required. The top CVE (2026-53413) scores CVSS 8.3. Patches have been available since late July. The question is whether your Zoom client — and every Zoom client across your organization’s fleet — is actually running them.
Zero-Click Is the Differentiator
Most vulnerability disclosures ask users to stop clicking links or opening attachments. Zoomsday doesn’t. The flaw lives in how Zoom’s client deserializes annotation formatting data — specifically in the CAnnoFormatBlock::Deserialize path. The annotation feature uses four fixed 128-byte buffers, and the parser copies data based on a wire-supplied character count without checking it against the buffer size. Supply an oversized count for the fourth buffer and you overwrite saved registers and the return address sitting below it on the stack. The attacker controls execution. The victim sees nothing.
That’s CVE-2026-53413. CVE-2026-53415 is a use-after-free in the same annotator, also leading to RCE. CVE-2026-53414 is a buffer overread causing denial of service. All three touch the annotation feature. The attack travels over Zoom’s normal encrypted transport, which means your firewall sees legitimate Zoom traffic right up until a participant’s machine is compromised.
AI Built a Working Exploit in Under 24 Hours
Here is the part that changes how you should think about your patch window. A Security researcher Idan Levcovich developed a working exploit for Zoomsday using publicly available AI models — specifically Claude Opus 4.7 and 4.8 — in fewer than 24 hours, using fewer than 20 prompts. No jailbreaking, no special access, no custom tooling. The researcher estimated that previously, the same exploit chain would have required a team of five people and roughly six months of effort. Levcovich’s own framing is worth reading directly: “This class of capability would previously have only been available to nation-state threat actors, but the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed.”
This matters for how you treat patch timing. The traditional assumption — that a gap of days or weeks between disclosure and weaponization is acceptable — does not hold when AI compresses the exploit development timeline to an afternoon. Zoomsday was disclosed publicly on August 11. By that point, a working exploit already existed. Your patch window was zero.
What to Do Now
Open Zoom, go to Help > About Zoom, and check your version. You need Zoom Workplace 7.1.5 or 7.0.6 (depending on release branch), Zoom Rooms 7.1.5, or Zoom Meeting SDK 7.1.5. If you’re below those numbers, you’re exposed.
- Zoom Workplace: 7.1.5 or 7.0.6 (check Help > About Zoom)
- Zoom Rooms: 7.1.5
- Zoom Meeting SDK: 7.1.5
- If you cannot patch immediately: Disable annotation in Zoom Admin > Account Settings > “Allow participants to annotate shared screens”
For enterprise deployments, the harder problem is the fleet. Many organizations disable Zoom auto-update for change-management or compliance reasons. That policy just became a liability. Zoom deployed a server-side annotation filter on July 15 that reduces exposure for unpatched clients on standard encrypted calls — but it is not a substitute for the client patch. Restrict screen-sharing annotation to hosts only as an additional control until every device is patched.
Developer Workstations Are the Target
Zoomsday is not just a consumer problem. Developer machines — where Zoom runs alongside IDE sessions, cloud CLI sessions, and access to production credentials — are high-value targets for exactly this kind of attack. A compromised developer workstation via Zoom gets an attacker access to everything open in that session. The calculus of “our security team will review the update before we push it” does not hold when the exploit development timeline is measured in hours. This is the moment to revisit auto-update exceptions and treat Zoom patching with the same urgency as an actively exploited browser vulnerability.
A Security reported the flaws to Zoom on June 10. Zoom shipped a client fix on June 22, added server-side filtering on July 15, and closed the final bug on July 20. Responsible disclosure timelines worked here. The patch is not the bottleneck — deployment is.
