A Zoom annotation bug let one person in a meeting run code on another participant’s machine. Zoom’s ZSB-26015 bulletin says a missing bounds check in the annotator can let a guest overwrite memory and reach remote code execution over the network. The vendor has shipped client and server fixes.
What the Zoom annotation bug actually did
The hole sat in Zoom’s annotation tools, the pens and text boxes people draw on a shared screen. Specifically, every client parsed those drawing messages automatically. Idan Levcovich of A Security reported the first two flaws. The firm says a guest needed no click, no extra download, and no on-screen warning from the victim.
Zoom rates CVE-2026-53413 at 8.3 and describes it as a buffer overwrite. A companion over-read, CVE-2026-53414, is a 6.5 denial-of-service bug. Then Zoom’s own offensive team found a third annotator issue, CVE-2026-53415, a use-after-free that can also lead to remote code execution. However, Zoom’s score still assumes some user interaction. A Security’s write-up is harsher. It says the same source compiled into Windows, macOS, iOS, Android, and Linux clients.
The researchers say they built a working exploit with fewer than 20 prompts on public AI models in under 24 hours. “This class of capability would previously have only been available to nation-state threat actors, but the model requiring elite teams, months of effort, and weapons-grade budgets has collapsed.” TMM already covered that shift when researchers used Anthropic’s Mythos to build a macOS exploit.
What Zoom patched, and who still needs an update
A Security reported the first bugs on June 10. Zoom shipped a client fix in Workplace 7.1.0 on June 22, then added a server-side filter on July 15. A later client, 7.1.5, closes the third CVE. Meanwhile, older clients on Zoom’s default encryption get that server filter. End-to-end encrypted meetings do not, because the server cannot inspect those packets.
The August 14 bulletin update says Workplace, Rooms, Meeting SDK, and Video SDK builds before 7.1.5 / 7.0.6 (or 2.6.5 on Video SDK) still need a bump for the full set. VDI clients for Windows need 7.0.11 or 6.6.16. Besides those version pins, Zoom tells users to grab the latest build at zoom.us/download. Nobody has said attackers used this in the wild.
As a result, the useful move is still a client update, not a new meeting setting. Admins who want extra margin can also raise a minimum client version, the same hygiene TMM flagged after other AI-sped bug hunts started shipping faster than patch cycles.
