Zoom rolled out emergency patches for a serious security bug. It could have allowed a malicious meeting participant to hijack another attendee’s computer without requiring a single click, download, or warning.
The vulnerability affects Zoom desktop and mobile apps on Windows, Mac, Linux, iOS, and Android. Security teams urge every Zoom user to update right away.
What happened
The flaw sits inside Zoom’s annotation tool (the feature that lets you draw, highlight, or type on a shared screen). Security researchers found attackers could abuse this tool to corrupt a device’s memory and execute code without the target noticing a thing.
The main bug, tracked as CVE-2026-53413 and nicknamed “Zoomsday” by the researchers who discovered it, carries a CVSS score of 8.3 and a “high” severity rating from Zoom. Two other issues were patched in the same update: a buffer overread (CVE-2026-53414) and a use-after-free flaw in the annotation function (CVE-2026-53415).
Quick answer: Yes, this bug is fixed. Zoom already released patched versions, and nobody has found evidence of hackers using it before the patch arrived.
How the attack worked
Zoom’s annotation tool relies on a custom protocol opening a direct line between the person sharing a screen and everyone watching. Researchers found attackers could trick this channel into handling a corrupted message.
Zoom apps automatically process incoming call data, so a malicious message could corrupt the receiving app’s memory and run code immediately. You didn’t need to click anything, download a file, or approve a prompt.
That zero-click design made the flaw dangerous. The attack ran automatically without needing any action from the victim.
Who found it (and the AI angle)
Researchers at A Security discovered the vulnerability. They describe their company as an autonomous offensive security research platform. The team found the flaw and built a working exploit in under 24 hours using fewer than 20 prompts on public AI models.
According to reporting relayed by Studio Global AI, the firm’s lead researcher told SC Media they worked with Anthropic’s Claude Opus models. A Security began analyzing Zoom’s annotation code on June 8, 2026, built a working exploit in about 24 hours, and notified Zoom on June 10, 2026. Zoom spent the next few weeks building and releasing server and app fixes before announcing the news this week.
Security professionals are talking about this case because of how fast the researchers found the flaw. AI tools are shrinking the gap between discovering a bug and turning it into an attack.
Who’s affected and what to do
The flaw affected Zoom Workplace apps on all major platforms running older builds. Zoom confirmed fixes in these versions:
| Product | Patched Version |
| Zoom Workplace (all platforms) | 7.1.5 and 7.0.6 |
| Zoom Rooms | 7.1.5 |
| Zoom Meeting SDK | 7.1.5 |
What you should do right now:
- Open Zoom and check Settings > About (or the equivalent on mobile) to see your current version.
- Update right away if your build is older than the patched versions listed above.
- IT administrators managing Zoom Rooms or enterprise deployments should push updates across all devices immediately.
Security teams haven’t found evidence of attackers abusing this bug in the wild. But zero-click flaws get high priority because victims never see them coming.
A separate, related incident: Windows account takeover flaw
Zoom handled another security issue last month. The company patched an unrelated flaw in its Windows client (CVE-2026-53412) with a 9.8 CVSS rating, one of the highest severity scores possible.
Bad input validation in Zoom desktop and VDI clients on Windows allowed remote attackers to hijack accounts without joining a call first. Zoom fixed it alongside 3 lower-severity privilege escalation bugs in Windows Zoom Rooms and VDI plugins.
Zoom reported no evidence that hackers exploited the Windows bug before the patch. Both cases involve different software bugs, but they show Zoom pushed out multiple major security updates in mid-2026.