Zoom fixes annotation vulnerabilities affecting meeting clients

Zoom has patched three vulnerabilities in its annotation feature that could allow a participant in a meeting to compromise another attendee’s client under the conditions described by security researchers. The issues are tracked as CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415. Zoom assigned CVSS scores of 8.3, 6.5 and 8.3 respectively.

The vulnerabilities affect the annotation capability used to draw or type on a shared screen. Researcher Idan Levcovich of A Security said the flaws could enable attacks between a screen sharer and viewers, without a victim needing to click a link, download a file or approve a visible prompt. Zoom released client fixes in June and July, before the public disclosure, and no exploitation had been reported at publication.

Versions addressed by Zoom

Zoom Workplace on supported platforms should be updated past versions 7.1.5 and 7.0.6 in the relevant release branches. Zoom Workplace VDI Client for Windows is affected before 7.0.11 and 6.6.16. Zoom Rooms and Zoom Meeting SDK are affected before 7.1.0, while the third flaw is addressed before 7.1.5.

Zoom documented the issues in ZSB-26015, ZSB-26016 and ZSB-26017. None of the three CVE identifiers was listed in CISA’s Known Exploited Vulnerabilities catalog when the report was published. The vendor’s records mark user interaction as required, although A Security characterised the demonstrated attack path as zero-click for the target.

How annotation messages became an attack surface

A Security’s reverse engineering describes annotations as structured objects rather than image files. The client sends counts followed by data, and one parser reportedly copied data into a fixed 128-byte buffer without ensuring that the declared size fitted. Because that field is last in the object, the researchers said an oversized value could overwrite memory beyond the buffer.

The researchers also described missing validation of a message sender’s role on the paths they traced. A client dispatcher was said to select a parser from the message type received over the wire without confirming whether the sender was the screen sharer or a viewer. Their account says that sending an object message where an acknowledgement was expected could make a client reconstruct the object.

The disclosure adds to the operational importance of timely remediation in collaboration platforms, alongside the wider security developments collected in current exposure in collaboration platforms for teams reviewing current exposure. A Security rated all three issues at 9.0 using CVSS 4.0, while Zoom’s published scores remain lower; the two assessments differ especially on the potential impact of the buffer over-read.

Business implication

Security and IT teams should identify Zoom Workplace, VDI, Zoom Rooms and Meeting SDK deployments, confirm the applicable fixed versions, and prioritise upgrades through normal endpoint-management processes. Conferencing software should remain in patch inventories because meeting features can process untrusted content from other participants.