Zoom has patched a zero-click remote code execution vulnerability that allowed one meeting participant to run code on another participant’s device without the victim clicking a link, opening a file, or accepting a prompt. The flaw, tracked as CVE-2026-53413, affected Zoom Workplace clients across supported desktop and mobile platforms through the meeting annotation protocol.
The attacker still had to join or host the same meeting, but the receiving client parsed the crafted annotation message automatically and showed no visible compromise warning. Users should update the installed Zoom client now, then confirm the version after it restarts. Joining a meeting on an older build does not prove exploitation, and the researchers did not report a known attack campaign.
Which Zoom versions include the fix?
The coordinated disclosure covers the native Zoom clients and related meeting products. Use the fixed release for the product and branch that is actually installed:
| Zoom product | Release containing the fixes |
|---|---|
| Zoom Workplace on supported platforms | 7.1.5 or 7.0.6, depending on the maintained branch |
| Zoom Rooms on supported platforms | 7.1.5 |
| Zoom Meeting SDK on supported platforms | 7.1.5 |
The main research describes versions through 7.0.5 as vulnerable and names Windows, macOS, Linux, iOS, and Android clients. Managed installations, VDI environments, Rooms appliances, and applications built with the Meeting SDK may follow separate deployment paths, so administrators should inventory each product instead of checking one employee laptop and assuming the estate is covered.
How the Zoom zero-click attack worked
Zoom’s annotation feature lets participants draw, type, add shapes, and place marks on a shared screen or whiteboard. Those marks are not sent as a flat picture. The client serializes an annotation object, sends it through Zoom’s meeting infrastructure, and the receiving client rebuilds the object for display.
Researchers at A Security found that the text-annotation parser trusted a sender-controlled count while copying data into a fixed-size buffer. A malicious participant could send a crafted annotation object that overwrote memory and redirected program execution. Because receiving clients parse meeting messages automatically, the victim did not have to enable annotation or interact with the crafted object.
The same disclosure also covers CVE-2026-53414, which could crash another participant’s client, and CVE-2026-53415, a use-after-free issue in the annotation component. The practical user decision is the same: update the native client rather than trying to disable one visible meeting control and assuming the underlying parser is no longer reachable.
How to check and update Zoom safely
- Open the installed Zoom Workplace application and select your profile picture.
- Choose Help and About Zoom Workplace. Record the full version number; the browser website version does not tell you whether the native client is patched.
- Select Check for Updates, install the offered release, and restart Zoom.
- Open About Zoom Workplace again and verify that the client reached the fixed branch shown above.
- If the update option is missing or the device is organization-managed, contact IT. Do not replace an MSI-, VDI-, Rooms-, or SDK-managed deployment with a random public installer.
Use the in-app updater or Zoom’s official Download Center. Search ads and unofficial mirrors can lead to unrelated malware; Gridinsoft has separately documented fake Zoom and WebEx installers that delivered Starland RAT. Updating the real client and verifying its version is safer than downloading the first file labeled “Zoom update.”
Does an old Zoom version mean the device was compromised?
No. A vulnerable version shows exposure, not evidence that someone executed the flaw. The attacker needed access to the same meeting, and the public research does not identify a reliable file name, process, log event, or network indicator that proves CVE-2026-53413 was used. Avoid treating a normal crash, camera problem, or unfamiliar participant as proof of code execution.
If a meeting was suspicious and the device later showed unexpected processes, security alerts, new software, camera or microphone activity, or account changes, preserve the meeting ID, time, participant list, Zoom logs, and relevant alerts. Update Zoom, disconnect the affected device from sensitive work if active compromise is plausible, run a trusted security scan, and have the organization review endpoint and identity logs. Change important passwords and revoke sessions from a separate trusted device when there is evidence of credential or session access.
This flaw is separate from CVE-2026-53412, the July Windows-only Zoom account-takeover issue. The CVE, affected platforms, mechanism, and fixed-version thresholds differ, so passing the July check does not replace the August update. Keeping collaboration clients current should remain part of the broader remote-work security baseline.
References
- Idan Levcovich, A Security. “ZOOMSDAY: How A Security Found a Nation-State Vulnerability in Zoom in One Day.” Published August 11, 2026. Primary research and coordinated disclosure.
- Zoom Support. “Viewing the Zoom Workplace desktop and mobile app version.” Accessed August 11, 2026. Official version-check instructions.
- Zoom Support. “Updating Zoom to the latest version.” Accessed August 11, 2026. Official update instructions.
