A critical Zoom vulnerability chain could have allowed an attacker to take control of another participant’s device simply by joining the same meeting.
The attack required no clicks, downloads, or other interaction from the victim.
Researchers at A Security dubbed the vulnerability chain “ZOOMSDAY” and said they developed a working exploit in less than 24 hours using fewer than 20 prompts with publicly available AI models.
The findings highlight both the potential severity of vulnerabilities in widely used collaboration platforms and the growing role of AI in accelerating offensive security research.
“The barrier to producing this class of weapon has collapsed, and it won’t come back,” A Security researchers said in their disclosure.
Key takeaways of the Zoom RCE exploit chain
- ZOOMSDAY enabled zero-click RCE, allowing an attacker to potentially compromise another Zoom participant’s device without any user interaction.
- The exploit affected major operating systems, with A Security confirming the attack against Zoom Client on Windows, macOS, iOS, and Android.
- AI accelerated exploit development, with A Security developing a working exploit in less than 24 hours using fewer than 20 prompts with publicly available AI models.
- Organizations should update Zoom immediately and reinforce patching with meeting access controls, endpoint monitoring, and other defense-in-depth measures.
Inside the Zoom zero-click RCE exploit chain
A Security’s research found that the ZOOMSDAY vulnerability chain affected Zoom’s native clients across major operating systems.
Researchers confirmed the zero-click remote code execution (RCE) exploit against Zoom Client v7.0.5 on Windows, macOS, iOS, and Android.
How the ZOOMSDAY exploit chain works
The vulnerability chain centered on memory corruption associated with Zoom’s annotation feature, which allows meeting participants to draw, highlight, or add information to shared content.
According to A Security, Zoom clients automatically processed data transmitted through the platform’s proprietary annotation protocol.
Researchers discovered they could manipulate this process with specially crafted messages that corrupted the receiving client’s memory and ultimately enabled remote code execution.
What attackers could do with ZOOMSDAY
What made ZOOMSDAY especially concerning was that exploitation did not require the victim to click a malicious link, open an attachment, or download a file.
An attacker could join or host a Zoom meeting and target another participant without requiring any action from that person or displaying an obvious indication that the device had been compromised.
The communication between Zoom clients also created multiple potential attack paths.
A Security found that a malicious meeting participant could target a presenter, while a compromised presenter could potentially target other participants.
Successful exploitation could allow malicious code to run on a victim’s device, creating opportunities to steal sensitive information, install additional malware, or access the device’s microphone or camera.
The ZOOMSDAY exploit chain involved three vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.
CVE-2026-53413
CVE-2026-53413 is one of the vulnerabilities associated with the Zoom annotation functionality exploited as part of the ZOOMSDAY chain.
The flaw contributed to the ability to manipulate how a Zoom client handled specially crafted annotation data sent during a meeting.
For an attacker, exploiting this weakness could help trigger unintended memory behavior on a targeted Zoom client.
When combined with the other vulnerabilities in the chain, it helped researchers progress toward executing attacker-controlled code without requiring interaction from the targeted participant.
CVE-2026-53414
CVE-2026-53414 is a memory over-read vulnerability in how Zoom processes character data received through its annotation protocol.
The issue occurs because Zoom allocates a memory buffer based on the character count specified in an incoming packet, even when the packet contains less data than that count indicates.
The unused portion of the allocated buffer is not cleared before it is processed, potentially exposing information already stored in the victim device’s memory.
A Security confirmed that the exposed memory could contain sensitive technical information, including live code and virtual function table (vtable) pointers from loaded software libraries.
An attacker could use these leaked memory addresses to determine where code is located in memory and help bypass address space layout randomization (ASLR), a security protection designed to make memory-based attacks more difficult.
Although the vulnerability does not provide complete device takeover on its own, the leaked memory information can make other memory-corruption vulnerabilities easier to exploit.
In the ZOOMSDAY chain, CVE-2026-53414 provided information an attacker could use to overcome memory protections and move closer to reliable RCE on the targeted Zoom client.
CVE-2026-53415
CVE-2026-53415 is a separate vulnerability discovered in Zoom’s annotation engine that could provide an attacker with another path to remote code execution.
The flaw affects how Zoom processes an annotation message used for auto-shape metadata.
According to A Security, Zoom’s parser could read attacker-controlled data directly into an internal linked-list structure without first validating the supplied pointers.
This created what researchers describe as a “write-what-where” condition, meaning an attacker could potentially control both the data written to memory and the location where it was written.
The capability can be dangerous because it can provide a path toward executing attacker-controlled code on the affected device.
Zoom had deployed a server-side mitigation designed to filter malicious messages before they reached vulnerable clients.
However, that protection could not be applied to end-to-end encrypted (E2EE) meetings because Zoom’s servers are unable to inspect the encrypted meeting content.
As a result, specially crafted messages could still reach vulnerable clients during E2EE meetings.
Zoom has already released fixes for the vulnerabilities.
How to mitigate the Zoom vulnerabilities
Updating vulnerable Zoom clients should be the priority, but organizations should also apply defense-in-depth controls to reduce exposure and contain the blast radius of a potential compromise.
This includes tightening meeting-level permissions, strengthening endpoint protections, and limiting the privileges available to compromised accounts and applications.
- Maintain accurate software inventories and SBOMs to identify affected software, and promptly update Zoom Workplace and other business-critical applications to remediate vulnerable versions.
- Restrict sensitive meetings to authenticated or approved participants and use waiting rooms to control access.
- Limit annotation, screen sharing, and other participant capabilities to trusted users when they are not required.
- Use endpoint detection and response tools to monitor Zoom endpoints for suspicious processes, persistence, or unusual device activity.
- Apply least-privilege and application-control policies to limit what attackers can access or execute after compromising an endpoint.
- Test incident response plans and use attack simulation tools with scenarios around endpoint compromise.
Together, these measures can reduce the overall attack surface and build resilience.
Bottom line
For security teams, ZOOMSDAY underscores a broader shift in the threat landscape.
AI is reducing the time and resources required to identify vulnerabilities and develop functional exploits.
Security leaders should account for this compressed attack timeline by prioritizing continuous exposure management, faster remediation, and regular validation of security controls.