Entrar
“Zoomsday” flaws could let one Zoom participant attack another
Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data.
The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process annotation data shared during meetings. The researchers named the set of flaws “Zoomsday.”
Affected applications are:
- Zoom Workplace on all supported platforms before version 7.1.5 and 7.0.6, depending on the release branch
- Zoom Workplace VDI Client for Windows before versions 7.0.11 and 6.6.16, depending on the release branch
- Zoom Rooms on all supported platforms before version 7.1.5
- Zoom Meeting SDK on all supported platforms before version 7.1.5
What can happen
What this means is that someone in the same Zoom meeting could send data that the Zoom app was not prepared to handle. Instead of simply displaying a drawing, text box, or other annotation, a vulnerable client could be tricked into crashing, leaking information, or even running attacker-controlled code.
Annotation features sound simple, but the underlying process is not. Your Zoom client receives structured data from another participant and turns that data into an object it can display on screen. According to the research, the annotation parser contained several memory-safety bugs. Like any software that processes data supplied by a third party, it has to be very careful about validating lengths, counts, and references before using them.
Remarkably, there is a discrepancy between the severity ratings assigned by the researchers, who rated them as Critical, and Zoom, which rated them as High.
The difference appears to come down to how the vulnerabilities are scored under the Common Vulnerability Scoring System (CVSS score). Zoom considers successful exploitation to require user interaction.
In practice, an attacker would first need to get into the same meeting as the intended victim. That could mean joining an open meeting, abusing a leaked meeting link, posing as an expected attendee, or compromising an account that already has access. Zoom considers it user interaction if the attacker persuades the target to join a meeting with the intent to compromise their machine.
How to stay safe
Zoom has published a security bulletin explaining which programs need to be updated and where to find the fixed versions.
To protect yourself from Zoomsday and have safe meetings:
- Update Zoom to the latest version as soon as possible.
- Restrict who can join your Zoom meetings. Use passcodes, waiting rooms, authenticated-user restrictions, and unique meeting links for sensitive calls.
- If features like annotation, whiteboards, remote control, file transfer, or third-party apps are not needed, consider turning them off, especially for meetings that have an open invitation nature.
- One crashed meeting is not proof of an attack, but if it happens on a regular basis, it’s worth investigating.
- Use an up-to-date, real-time anti-malware solution to block malicious code on your devices.
- Organizations should also check their device-management tools to make sure every deployed Zoom client is receiving updates.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
