Credit: Shutterstock
A vulnerability in one of Zoom’s meeting tools could have handed an attacker control of another person’s computer.
On August 11, 2026, researchers at the security firm ‘A Security’ disclosed a critical vulnerability chain in Zoom, publicly naming it “Zoomsday.” The most severe issue, tracked as CVE-2026-53413, lived inside Zoom’s annotation feature, the tool that lets meeting participants draw, highlight, or add text while someone shares their screen. Zoom’s own security team rated the flaw as high severity. The company has since released patches, and no exploitation has been reported in the wild.
Zoom’s annotation feature runs on a proprietary protocol that opens a direct communication channel between whoever is sharing their screen and whoever is watching it. Researchers found that the protocol responsible for reading incoming annotation data, called CAnnoFormatBlock::Deserialize, trusted attacker-controlled size information without properly checking it. That let an attacker send an oversized, specially built message that overflowed a fixed-size memory buffer.
Once that buffer overflowed, it could corrupt nearby memory and change how the application behaved, allowing code to run inside the Zoom client itself.
The result was a zero-click attack. A victim did not need to click a link, download a file, approve a prompt, or take any visible action. Simply being in a meeting with an attacker who joined or hosted the call was enough. Researchers demonstrated the exploit on macOS by silently opening the Safari browser on a target machine. The demonstration itself was harmless, but the same technique could be used to steal data, turn on a camera or microphone, or install other software without the victim noticing anything unusual.
The flaw affected Zoom clients across every major platform, including Windows, macOS, Linux, iOS, and Android.
What stands out most about this disclosure is how quickly the flaw was found. According to A Security, a single researcher used fewer than 20 prompts on publicly available AI models to identify the vulnerability and build a working exploit in less than 24 hours. Work of that kind has historically taken experienced vulnerability researchers days or weeks of manual study.
This does not mean anyone can now become a skilled hacker by opening a chatbot. Researchers still need to know which parts of an application to examine and how to interpret what an AI model produces. But the case shows that AI is shortening the distance between spotting a weakness and turning it into a working attack. That same speed benefits defenders too, since it also helps security teams find and fix flaws faster than before.
Along with CVE-2026-53413, Zoom disclosed three related issues in the same bulletin cycle, including a medium-severity bug, tracked as CVE-2026-53414, that could leak memory contents from the Zoom client. Zoom has released updated versions across its Workplace, Rooms, and Meeting SDK products that close all four issues.
Security researchers recommend the following steps:
- Update Zoom on every computer, phone, and tablet you use, even if the app appears to be working normally.
- For organizations managing Zoom centrally, confirm that devices are actually receiving the latest version rather than relying on individual employees to update manually.
- Meeting hosts can reduce exposure by using passcodes, waiting rooms, and authenticated participant requirements to control who can join a call.
A Security says Zoom is used by roughly 70% of the Fortune 100, which gives a flaw like this a wide potential reach. While no attacks exploiting Zoomsday have been confirmed, the disclosure adds to a growing pattern in cybersecurity that AI tools are making it faster and cheaper to discover serious vulnerabilities in widely used software. That raises the pressure on major platforms to find and patch these weaknesses before someone with different intentions does.
