Multiple vulnerabilities in Zoom’s annotation engine could allow a malicious meeting participant to compromise another attendee’s device by sending specially crafted meeting data.
The most serious issue, tracked as CVE-2026-53413, is a buffer overwrite that Zoom says could lead to remote code execution. A second flaw, CVE-2026-53414, involves a buffer over-read and can be abused to crash another participant’s client.
The vulnerabilities were discovered on June 8 by A Security senior vulnerability researcher Idan Levcovich while analyzing Zoom’s Android client. A working exploit against Zoom 7.0.5 was confirmed the following day, and the findings were privately reported to Zoom on June 10.
A Security says much of the reverse-engineering and vulnerability research was assisted by publicly available AI models, which helped researchers rank potentially interesting native functions, reconstruct Zoom’s proprietary annotation protocol, and identify unsafe memory operations.
Zoom is a widely used video conferencing platform by businesses, government organizations, schools, and consumers. Its Workplace application runs on Windows, macOS, Linux, Android, and iOS, while the company also provides dedicated Zoom Rooms software, virtual desktop infrastructure clients, and a Meeting SDK for embedding Zoom functionality into other applications.
Bug in Zoom's annotation parser
The researchers focused on libannotate.so, a native library responsible for Zoom's annotation features, which allow meeting participants to draw, add text, and place shapes over shared content.
Rather than transmitting annotations as images, Zoom serializes them into structured objects that are sent through the meeting infrastructure and reconstructed by the recipient's client.
According to A Security, the vulnerable parser trusted several length and count values supplied by the sender without sufficiently checking them against the size of destination buffers.
CVE-2026-53413 occurs while processing formatting information associated with text annotations. The vulnerable CAnnoFormatBlock::Deserialize routine contains several fixed-size 128-byte buffers but accepts 32-bit character counts from the network.
An oversized value could therefore cause the parser to copy more data than the destination buffer can hold, overwriting adjacent memory.
The researchers demonstrated exploitation on macOS, where they were able to corrupt control-flow data and execute code on the receiving system. Their proof of concept launched Safari on the victim machine.
Zoom rates CVE-2026-53413 as high severity and confirms that exploitation may allow one meeting participant to remotely execute code on another participant's device.
A second issue, CVE-2026-53414, involves another missing bounds check in the annotator. A Security found that Zoom could allocate a buffer based on a declared character count while receiving substantially fewer bytes, potentially exposing uninitialized memory.
Zoom's advisory describes the practical impact as denial-of-service and assigns the vulnerability a medium severity.
A Security also disclosed CVE-2026-53415, a separate annotation-parsing flaw involving attacker-controlled pointers in an internal linked list structure. According to the researchers, Zoom initially mitigated malicious messages at the server level before addressing the problem on the client side, because server filtering cannot inspect annotation traffic protected by end-to-end encryption.
Zoom released fixes for CVE-2026-53413 and CVE-2026-53414 in June and later shipped additional annotation security changes.
Zoom Workplace users should upgrade to version 7.1.5 or later, or 7.0.6 for systems remaining on that branch. Zoom also lists patched releases for its VDI Client, Zoom Rooms, and Meeting SDK products.
Because attacks originate from meeting traffic rather than from conventional file downloads, organizations should not rely on users to recognize suspicious content. Keeping Zoom clients centrally updated is the most effective protection against these vulnerabilities.
Leave a Reply