Zoom has patched a zero-click vulnerability in its annotation feature that could let one meeting participant take over another attendee’s device. The research behind the disclosure comes from A Security, which named the flaw Zoomsday.
At the center is CVE-2026-53413, a remotely triggerable stack buffer overflow in CAnnoFormatBlock::Deserialize inside libannotate.so, part of the proprietary protocol behind annotations. Zoom clients parse whatever data arrives, so a crafted message can corrupt the receiving client’s memory and run code on it. The protocol opens a direct channel between viewer and sharer, letting an attacker target each participant individually, and in large meetings a single message could expose many users at once.
Nothing is required from the victim beyond being in the meeting. No click, no download. Attackers could join or host a call, silently take control of devices, steal data, activate cameras or microphones, and install malware.
The team aimed at the Android app because it ships closed-source with a broad native-code attack surface. Dynamic tracing pointed at the annotation library, and reversing revealed that annotation objects get serialized and reconstructed from network data the attacker controls, with origin checks missing.
Two more bugs ride along: CVE-2026-53414, a missing bounds check that triggers a buffer overread and crashes a participant’s client, and CVE-2026-53415, a use-after-free Zoom had already identified. Client patches and a server-side mitigation are rolling out now.
