In short: On August 11, 2026, Zoom patched a critical zero-click vulnerability dubbed "Zoomsday" (CVE-2026-53413): any meeting participant or host could silently take full control of another participant's device with no user interaction required. The flaw was discovered by Israeli firm A Security using just 20 prompts to their offensive AI tool. All platforms are affected: Windows, macOS, iOS, Android, and Linux. The fix is in Zoom Workplace 7.1.5 — update immediately.
What Happened
On August 11, 2026, Zoom published four security bulletins (ZSB-26015 through ZSB-26018). The most critical, CVE-2026-53413 — nicknamed "Zoomsday" by the researchers who found it — affected the annotation feature used during screen sharing and enabled arbitrary code execution on any other participant's device. No action from the victim was required: no link to click, no file to open, no dialog to confirm.
The vulnerability was found by Israeli firm A Security. According to their report, their offensive AI security harness needed just 20 prompt iterations to discover the flaw — a sign that the barrier to finding zero-day vulnerabilities is falling fast. For context on how attackers monetize access to compromised devices, read our overview of how infostealers steal passwords and cookies.
Technical Mechanics: Where the Flaw Lived
The vulnerability was in Zoom's annotation feature — the tool that lets meeting participants draw, highlight, and label things on top of a shared screen. Zoom uses a proprietary protocol for this feature, opening a direct data channel between the screen-sharer and viewers.
The code that handled text annotation data used fixed-size 128-byte buffers but blindly trusted 32-bit character counts sent over the network. By sending specially crafted data, an attacker could overflow the buffer and execute arbitrary machine code. The attack worked against Zoom Workspace on Windows, macOS, iOS, Android, and Linux.
The most dangerous aspect: the attack left no visible trace. The victim saw no suspicious messages, system alerts, or permission dialogs. Being in the same meeting was the only requirement.
What an Attacker Could Do to Your Device
With code execution in Zoom's process context, an attacker could do virtually anything the operating system permits a running application to do. Depending on Zoom's process permissions, this includes: reading files from the user profile and system directories, logging keystrokes, activating the camera and microphone, extracting saved passwords and tokens from browsers, installing additional malware, and moving laterally across the local network.
The corporate risk is especially high: one compromised meeting and the attacker is inside the company perimeter. Protecting the network layer reduces the blast radius: an encrypted LiMP VPN tunnel hides your traffic and real IP address, limiting device visibility to outside observers and interceptors.
Who Was at Risk
Anyone using an unpatched version of Zoom was at risk — and that means tens of millions of users worldwide. The threat was especially acute for people who regularly join public webinars, client calls, or any meeting reached via an unfamiliar link: an attacker could simply host a meeting and invite the target. For risks related to the public networks many people use for Zoom calls, see our guide on public Wi-Fi security.
How to Protect Yourself Now
Update Zoom to the latest version. The fix is included in Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5. To check: open Zoom → click your profile → Help → Check for Updates.
Enable automatic updates. In Zoom settings: General → check "Automatically keep Zoom up to date" — this ensures future critical patches apply without manual action.
Admins: disable annotations organization-wide. Until all devices are updated, remove the annotation feature from the Zoom management portal — the annotation engine is exactly where this flaw lived.
Do not join calls from unknown or suspicious sources. Meeting links from cold emails, unsolicited messages, or social media are a potential attack vector. If the sender is unknown, verify via a separate channel before joining.
Protect the network layer. LiMP VPN encrypts all device traffic and hides your real IP address — especially important when joining corporate calls from public venues like cafés, airports, and hotels.
Sources
- SecurityLab.ru — AI-powered exploit discovery: Zoom zero-click flaw found in 20 prompts
- Techora.ru — Zoom vulnerability allowed device takeover via screen sharing
- SecurityAffairs — Zoom Patches "Zoomsday" Zero-Click Flaw Enabling Remote Code Execution
- SecurityWeek — Zoom Patches Zero-Click Code Execution Vulnerability