Researchers have found three vulnerabilities in the popular Zoom meeting platform that could let one meeting participant attack another through malicious collaboration data.

The vulnerabilities, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, affect the code Zoom uses to process annotation data shared during meetings. The researchers named the set of flaws “Zoomsday.”

Affected applications are:

• Zoom Workplace on all supported platforms before version 7.1.5 and 7.0.6, depending on the release branch
• Zoom Workplace VDI Client for Windows before versions 7.0.11 and 6.6.16, depending on the release branch
• Zoom Rooms on all supported platforms before version 7.1.5
• Zoom Meeting SDK on all supported platforms before version 7.1.5

What can happen

What this means is that someone in the same Zoom meeting could send data that the Zoom app was not prepared to handle. Instead of simply displaying a drawing, text box, or other annotation, a vulnerable client could be tricked into crashing, leaking information, or even running attacker-controlled code.

Annotation features sound simple, but the underlying process is not. Your Zoom client receives structured data from another participant and turns that data into an object it can display on screen. According to the research, the annotation parser contained several memory-safety bugs. Like any software that processes data supplied by a third party, it has to be very careful about validating lengths, counts, and references before using them.

Remarkably, there is a discrepancy between the severity ratings assigned by the researchers, who rated them as Critical, and Zoom, which rated them as High.

The difference appears to come down to how the vulnerabilities are scored under the Common Vulnerability Scoring System (CVSS score). Zoom considers successful exploitation to require user interaction.

In practice, an attacker would first need to get into the same meeting as the intended victim. That could mean joining an open meeting, abusing a leaked meeting link, posing as an expected attendee, or compromising an account that already has access. Zoom considers it user interaction if the attacker persuades the target to join a meeting with the intent to compromise their machine.

How to stay safe

Zoom has published a security bulletin explaining which programs need to be updated and where to find the fixed versions.

To protect yourself from Zoomsday and have safe meetings:

• Update Zoom to the latest version as soon as possible.
• Restrict who can join your Zoom meetings. Use passcodes, waiting rooms, authenticated-user restrictions, and unique meeting links for sensitive calls.
• If features like annotation, whiteboards, remote control, file transfer, or third-party apps are not needed, consider turning them off, especially for meetings that have an open invitation nature.
• One crashed meeting is not proof of an attack, but if it happens on a regular basis, it’s worth investigating.
• Use an up-to-date, real-time anti-malware solution to block malicious code on your devices.
• Organizations should also check their device-management tools to make sure every deployed Zoom client is receiving updates.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Researchers built a Zoom zero-click RCE exploit in under 24 hours using AI, exposing risks to Windows, macOS, iOS, and Android users.

The post Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours appeared first on TechRepublic.

Zoom patches a zero-click flaw that could let a meeting participant execute code on another user’s computer through the annotation feature.

Zoom has patched four vulnerabilities, including a critical zero-click flaw, tracked as CVE-2026-53413, in its annotation feature. CVE-2026-53413 is a memory corruption issue found by A Security that could allow a meeting participant to execute code on another participant’s computer.

Due to its impact, the researchers dubbed the flaw “Zoomsday,” it affects Zoom clients on all supported platforms and is linked to the proprietary protocol used by the annotation function. Zoom has now begun rolling out security updates to address the issue.

“Ⓐ Security, the Autonomous Offensive Security and Remediation Platform, discovered a critical flaw in Zoom that let an attacker take complete control of another user’s device during a live call. No click, no download, and nothing required of the victim but being in the meeting.” reads the report published by A Security. “The vulnerability is present in every version of Zoom on every device and operating system: Windows, Mac, iPhone, Android and Linux. The vulnerability exists in all versions up to and including 7.0.5.”

The flaw can corrupt memory through a specially crafted message. Attackers could exploit it to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.

“A Research was able to exploit the fact that every Zoom client automatically parses whatever it receives, sending a specially crafted message to corrupt the receiving client’s memory and run code on it.” continues the advisory. “The protocol opens a direct channel between a viewer and a sharer, letting the attacker target each participant individually.”

Attackers could join or host a Zoom meeting and silently take control of participants’ devices without any user interaction. Once compromised, they could steal data, activate microphones or cameras, or install malware. In large meetings, a single malicious message could expose multiple participants at once.

Zoom’s Android client was chosen as a target because it is closed-source, widely deployed, and exposes a large native-code attack surface. Researchers first ranked 3,762 functions across 70 libraries, but found the JNI-focused approach missed remotely reachable code. Dynamic tracing instead identified libannotate.so and its proprietary annotation protocol.

Reverse engineering showed that annotation objects are serialized and rebuilt from attacker-controlled network data without adequate origin checks. Researchers discovered CVE-2026-53413, a remotely triggerable stack buffer overflow in CAnnoFormatBlock::Deserialize. A wire-controlled count can exceed fixed 128-byte buffers, allowing data to overwrite adjacent memory. The flaw can be reached through Zoom’s normal encrypted transport, requiring no victim interaction or instrumentation.

A Security also found CVE-2026-53414, a missing bounds check in Zoom’s annotator that can cause a buffer overread and crash a meeting participant’s client, enabling DoS attacks. It also identified CVE-2026-53415, a use-after-free flaw, but Zoom had already discovered the issue before A Security reported it.

“Because a zero-click RCE requires no user interaction, we prioritized giving customers time to receive both the client patch and the server-side mitigation before publishing.” concludes the report. “This post follows that coordinated timeline, and we are releasing it alongside CVE assignment,” A Security notes.

This week, Zoom released Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 for all supported platforms to address the above vulnerabilities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zoomsday)

Zoom patched a critical Windows flaw that could enable remote account takeover, along with three high-severity privilege-escalation vulnerabilities.

The post Critical Zoom Flaw Could Let Attackers Take Over Windows Accounts appeared first on TechRepublic.

Catch up on the week's biggest tech news, including Google's app store shakeup, Apple's AI expansion, OpenAI's hardware plans, and critical security threats.

The post AI Hardware, App Store Shifts, and Security Scares Define This Week in Tech appeared first on TechRepublic.

Zoom warns of a critical Windows flaw, tracked as CVE-2026-53412, that could let attackers take over accounts without authentication.

Zoom has fixed a critical Windows vulnerability, tracked as CVE-2026-53412 (CVSS score of 9.8) that could allow unauthenticated attackers to hijack user accounts. The flaw affects older versions of Workplace, the Windows VDI Client, and the Meeting SDK for Windows.

“Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access.” reads the advisory.

The company Offensive Security team discovered the vulnerability. The company did not provide technical details about the vulnerability.

The company also addressed the following vulnerabilities:

• CVE-2026-53410 (CVSS score of 8.8) – A race condition in Zoom Workplace, VDI Client/Plugin, Rooms, and Remote Control for Zoom Contact Center on Windows could let an authenticated local user gain higher privileges during installation or uninstallation.
• CVE-2026-53409 (CVSS score of 8.8) – An improper privilege management flaw in Rooms for Windows could let an authenticated local user escalate privileges.
• CVE-2026-53411 (CVSS score of 8.8) – An input validation flaw in the Workplace VDI Plugin for Windows could let an authenticated local user gain elevated privileges.

Users should update to the latest versions as soon as possible.

None of the above issues is currently under active exploitation in the wild.

In January, the Cloud-based video conferencing and online collaboration platform released security updates to address multiple vulnerabilities, including command injection, tracked as CVE-2026-22844 (CVSS score of 9.9), in Node Multimedia Routers (MMRs) that could result in remote code execution.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Zoom)

Security updates are not just for enterprises with a dedicated security team and a change-management calendar. For consumers and small businesses, they are one of the simplest ways to shut down known attack paths before criminals get a chance to use them.

That matters because attackers love these flaws. because browser bugs, code execution issues, authentication bypasses, and privilege-escalation problems can be turned into a foothold, a data theft opportunity, or a full system compromise if left unpatched.

If you only do one thing after reading a security advisory, make it this: update the affected software promptly, restart when required, and verify the version afterward.

Adobe

Adobe released a large batch of security updates covering ColdFusion, Commerce/Magento Open Source, and Experience Manager. The ColdFusion bulletin alone includes multiple critical flaws that could lead to arbitrary code execution.

The updates and instructions can be found on the pages we linked to.

Chrome

Google patched 15 security flaws in Chrome, including two critical use-after-free bugs in Ozone. The fixes are in Chrome 150.0.7871.124/.125, depending on platform.

You can find an explanation of the version numbering system and step-by-step instructions in our guide to how to update Chrome on every operating system.

Firefox

Mozilla fixed two critical Firefox flaws in Firefox 152.0.6, and it says public exploit code exists for both issues. One affects JavaScript/WebAssembly and the other involves DOM navigation and site isolation, which makes this more than routine housekeeping.

Users should update Firefox to version 152.0.6 as soon as possible. For most users this can simply be done by restarting the browser. If you see the “What’s new” tab, the update is complete.

VMWare

Broadcom released a fix for a critical authentication bypass in VMware Avi Load Balancer, tracked as CVE-2026-47865. The issue could allow a network-accessible attacker to reach the Avi Control Plane, which makes it especially important in environments that expose management services or rely on load balancers at the edge.

Updates and the instructions to apply them can be found in the Security Advisory.

Zoom

Zoom Security Bulletin ZSB-26014 covers a critical issue in Zoom Workplace for Windows, described as improper input validation. The public record identifies the issue as CVE-2026-53412.

For users, the action item is to update Zoom Workplace for Windows to the vendor-fixed release as soon as it is available in your environment. For small businesses, that means updating not just the app on employee laptops, but also any centralized deployment package so the old build doesn’t come right back on the next install cycle.

---

---

A list of topics we covered in the week of February 23 to March 1 of 2026

The post A week in security (February 23 – March 1) appeared first on Security Boulevard.

Lots of startups use Google’s productivity suite, known as Workspace, to handle email, documents, and other back-office matters. Relatedly, lots of business-minded webapps use Google’s OAuth, i.e. “Sign in with Google.” It’s a low-friction feedback loop—up until the startup fails, the domain goes up for sale, and somebody forgot to close down all the Google stuff.

Dylan Ayrey, of Truffle Security Co., suggests in a report that this problem is more serious than anyone, especially Google, is acknowledging. Many startups make the critical mistake of not properly closing their accounts—on both Google and other web-based apps—before letting their domains expire.

Given the number of people working for tech startups (6 million), the failure rate of said startups (90 percent), their usage of Google Workspaces (50 percent, all by Ayrey’s numbers), and the speed at which startups tend to fall apart, there are a lot of Google-auth-connected domains up for sale at any time. That would not be an inherent problem, except that, as Ayrey shows, buying a domain with a still-active Google account can let you re-activate the Google accounts for former employees.

Read full article

Comments

© Aurich Lawson | Getty Images