cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Zoom Patches Zero-Click RCE and Three Other Vulnerabilities

· Original article ↗

Summary

Zoom patched four vulnerabilities, including CVE-2026-53413, which A Security says could enable zero-click remote code execution through the annotator protocol. The flaws affected Zoom clients and VDI products.

Key points

  • A Security reported that CVE-2026-53413, a missing bounds check in the text annotator, could let a meeting participant send a crafted message that causes memory corruption and remote code execution without victim interaction.
  • A Security said the annotator protocol opens a direct channel between meeting viewers and sharers, allowing an attacker to target participants individually.
  • CVE-2026-53414 is an annotator buffer overread that could enable denial-of-service attacks; CVE-2026-53415 is a use-after-free flaw that Zoom had already discovered.
  • Zoom said Workplace versions 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 include fixes for the three annotator vulnerabilities.
  • Zoom also patched CVE-2026-53416, a path traversal flaw leading to information disclosure, in specified Workplace VDI Client and VDI Plugins versions.

Article Details

Vulnerability Types
  • Memory corruption
  • Missing bound check leading to an out-of-bounds write
  • Buffer overread
  • Use-after-free
  • Path traversal
Severity
Severe; CVE-2026-53413 enables zero-click remote code execution
Exploitation Status
unknown
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1203 · Exploitation for Client ExecutionA crafted message sent through Zoom's annotator protocol could exploit a receiving client and execute code on a participant's machine.

CVE

CVE-2026-53413Zoom Communications · Zoom ClientsThe most severe of the three bugs is CVE-2026-53413, a memory corruption issue that allowed a meeting participant to execute code on another participant’s machine, says A Security, which found the bug and named itCVE-2026-53414Zoom Communications · Zoom ClientsAdditionally, A Security found CVE-2026-53414, another missing bound check in the annotator, which could be exploited to trigger a buffer overread and target any meeting participant with a denial-of-service (DoS) attack.CVE-2026-53415Zoom Communications · Zoom ClientsThe cybersecurity firm says it also identified CVE-2026-53415, a use-after-free flaw in the annotator function, but learned after reporting it that Zoom had already discovered it.CVE-2026-53416Zoom Communications · Zoom VDIand 6.6.16, and Workplace VDI Plugins versions 7.0.11 and 6.6.15, for all platforms, with patches for CVE-2026-53416, a path traversal flaw leading to information disclosure.

Vendors

ZoomZoom on Tuesday announced rolling out patches for four vulnerabilities in its products, including a severe flaw that allowed zero-click remote code execution (RCE).

Products

WorkPlaceOn Tuesday, Zoom announced that Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms contain fixes for all three vulnerabilities.Workplace VDI PluginsZoom also rolled out Workplace VDI Client for Windows versions 7.0.11 and 6.6.16, and Workplace VDI Plugins versions 7.0.11 and 6.6.15, for all platforms, with patches for CVE-2026-53416, a path traversal flaw leadingZoom Meeting SDKOn Tuesday, Zoom announced that Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms contain fixes for all three vulnerabilities.Zoom RoomsOn Tuesday, Zoom announced that Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms contain fixes for all three vulnerabilities.Zoom Workplace VDI ClientZoom also rolled out Workplace VDI Client for Windows versions 7.0.11 and 6.6.16, and Workplace VDI Plugins versions 7.0.11 and 6.6.15, for all platforms, with patches for CVE-2026-53416, a path traversal flaw leading

Related Articles