Zoomsday RCE Flaw Patched in Zoom Clients
A buffer overflow in Zoom's annotator function (CVE-2026-53413), dubbed Zoomsday, could let a meeting participant achieve remote code execution on another participant without interaction.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CIS/MS-ISAC issued an advisory covering a vulnerability in Zoom Clients caused by a missing bounds check in the annotator function, resulting in a buffer over-write. An attacker who joins or hosts a Zoom meeting could exploit this flaw to execute code on another participant's device with no user interaction required, potentially stealing data, activating cameras or microphones, and installing malware. In large meetings, a single malicious action could compromise multiple participants simultaneously.
The vulnerability, tracked as CVE-2026-53413 and nicknamed "Zoomsday" by open-source reporting, affects Zoom Workplace clients across all supported platforms prior to versions 7.1.5 and 7.0.6, the Zoom Workplace VDI Client for Windows prior to 7.0.11 and 6.6.16, Zoom Rooms prior to 7.1.0, and Zoom Meeting SDK prior to 7.1.0. There are currently no reports of in-the-wild exploitation, but given the network-based, zero-click nature of the flaw and Zoom's widespread enterprise use, organizations should prioritize patching.
MS-ISAC recommends applying vendor updates immediately after testing, alongside standard vulnerability management practices including patch management, vulnerability scanning, network segmentation, least-privilege enforcement, and anti-exploitation features.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-zoom-clients-could-allow-for-remote-code-execution_2026-081
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs