Zoom's annotation parser trusts the room: three CVEs turn any attendee into an attack surface

Researchers have disclosed three vulnerabilities in the code Zoom uses to process annotation data shared during meetings, and the attacker in the threat model is not a remote scanner but the person in the call with you ^[1][2]. The set, named "Zoomsday" by the researchers and tracked as CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415, can reportedly result in a crashed client, information disclosure, or attacker-controlled code execution ^[3][4].

The mechanism is unglamorous and familiar. Your client receives structured data from another participant and turns it into an object it can draw on screen ^[5]. According to the research, the annotation parser contained several memory-safety bugs, meaning it did not adequately validate lengths, counts, and references before using them ^[6][7]. A drawing or text box arrives as attacker-shaped input and gets parsed by code that assumed good faith.

The affected list is wider than the desktop app. Zoom Workplace on all supported platforms is affected before version 7.1.5 or 7.0.6, depending on release branch; the Workplace VDI Client for Windows before 7.0.11 or 6.6.16, again by branch; Zoom Rooms on all supported platforms before 7.1.5; and the Zoom Meeting SDK on all supported platforms before 7.1.5 ^{[8][9][10][11]}. That is four product lines, two of which most patch dashboards do not treat as endpoints ^[12].

Then there is the scoring argument. The researchers rated the flaws Critical; Zoom rated them High ^[13]. The gap comes down to CVSS, where Zoom considers successful exploitation to require user interaction, on the basis that persuading the target to join a meeting counts as interaction ^[14][15]. That is a defensible reading of the metric and a poor description of the operational reality. Getting into the same meeting as a victim can mean joining an open meeting, abusing a leaked link, posing as an expected attendee, or using an already-compromised account with access ^[16]. External-guest culture has made all four routine.

Zoom has published a security bulletin listing the affected programs and the fixed versions ^[17]. Beyond patching, the practical controls are the ones that shrink who can reach the parser: passcodes, waiting rooms, authenticated-user restrictions, and unique links for sensitive calls ^[18]. Where annotation, whiteboards, remote control, file transfer, and third-party apps are not needed, turning them off removes the input path, and Malwarebytes specifically flags open-invitation meetings as the place to do it ^[19]. Organisations should also confirm through device management that every deployed client is actually receiving updates, which is where the Rooms hardware and SDK-embedded builds tend to fall out of scope ^[20].

One useful detection note from the writeup: a single crashed meeting proves nothing, but repeated crashes are worth investigating ^[21]. Memory corruption fails loudly before it fails usefully, and a client that dies whenever a particular guest starts drawing is a signal, not a bug report.