Zoom Patched Three Annotation Flaws That Could Enable Meeting-Client Takeover

Summary

Researchers say three Zoom annotation flaws could let meeting participants take over other attendees’ clients without interaction. Zoom patched them in June and July; no exploitation had been reported. The company and researchers differ on severity and impact.

Key points

• The flaws affect Zoom’s screen annotation tool and are tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.
• Researchers say a meeting participant could exploit the flaws to take over another attendee’s client without a click or visible prompt.
• The researchers’ reverse engineering describes an unchecked annotation-object length and a message dispatcher that does not verify the sender’s role.
• Zoom shipped fixes in June and July. Affected products include Zoom Workplace, its Windows VDI Client, Zoom Rooms, and the Meeting SDK; fixed-version thresholds vary by product and branch.
• No exploitation had been reported at publication, and the article says none of the three CVEs appeared in CISA’s Known Exploited Vulnerabilities catalog.
• The researchers rate all three flaws 9.0 under CVSS 4.0; Zoom’s scores are lower, and the company describes the over-read as potentially causing denial of service rather than confidentiality impact.
• A Security says it developed a working exploit in under a day using publicly available AI models; the article notes that the claim cannot be independently checked because the models were not named.

MITRE ATT&CK

CVE

People

Vendors

Products

Related Articles

• Fake Anthropic AI Preview Emails Target Google and Microsoft Credentialscofense.comZoom