Anyone sharing their screen on a Zoom call could have had their computer taken over by anyone watching, and anyone watching could have had theirs taken over by the presenter.
The flaw sat in the annotation tool — the feature that lets participants draw and type on a shared screen — and it asked nothing of the victim beyond being in the meeting. No click, no download, no prompt, and nothing on screen to indicate it had happened.
The patches are not new. Client fixes shipped in June and July, roughly two months before the flaws were made public, and no exploitation has been reported as of publication. None of the three identifiers appear in CISA’s Known Exploited Vulnerabilities catalog.
Affected Versions
The versions that close the vulnerabilities:
- Zoom Workplace, all supported platforms, before 7.1.5 and 7.0.6 in their respective branches
- Zoom Workplace VDI Client for Windows, before 7.0.11 and 6.6.16
- Zoom Rooms and Zoom Meeting SDK, all platforms, before 7.1.0, and before 7.1.5 for the third flaw
Discovery and Exploit Development
The research came from A Security, an Israeli-founded offensive-security startup that left stealth in June with $37 million in funding. The firm says it went from finding the flaw to a working exploit in under a day, using fewer than 20 prompts on publicly available AI models.
Nobody outside the company can verify that claim: the writeup names no specific model. Zoom also rates the bugs lower than the firm does, and credits one of the three to its own internal team.
How the Vulnerabilities Work
Zoom has published no technical detail, so the internals come from the firm’s own reverse engineering. A drawing does not cross the network as a picture. The client turns it into a structured object and sends it as a run of counts followed by data, and the receiver trusts those counts to decide how much to read.
One of those counts fills a fixed 128-byte buffer with no check that the data fits. Because it is the object’s last field, an oversized count runs past the end and over the return address.
What allows a single malformed drawing to reach the whole room is a missing check on where a message came from. Every viewer holds a channel to whoever is sharing, and the sharer holds one back that is meant to carry acknowledgements. On the paths the researchers traced, the dispatcher reads a message’s type number off the wire and hands it to the matching parser without verifying which seat the sender occupied. Message type 0x10001 means “here is an object”; 0x10002 means “I received yours.” Send the first where the second belongs, and the victim’s client rebuilds the object in full.
CVE Identifiers and Scoring Discrepancies
Zoom tracks the flaws as:
- CVE-2026-53413 (CVSS score: 8.3) — buffer over-write, covered by ZSB-26015
- CVE-2026-53414 (CVSS score: 6.5) — buffer over-read, covered by ZSB-26016
- CVE-2026-53415 (CVSS score: 8.3) — use-after-free, covered by ZSB-26017
A Security rates all three at 9.0 under CVSS 4.0, a score that appears in none of Zoom’s bulletins. Zoom issues its own CVE records, and NIST no longer routinely re-scores them, so the lower figures will likely stand. All three vendor vectors also mark user interaction as required, which conflicts with the zero-click framing presented by the researchers.
The two accounts diverge furthest on the over-read. The firm says it recovered uninitialized heap memory from a victim’s client containing live code and vtable pointers — the material needed to bypass address-space layout randomization. Zoom’s advisory describes the same bug as potentially enabling a denial-of-service and scores its confidentiality impact as none.
Credit is also split: two bulletins name Idan Levcovich of A Security, while the bulletin covering the use-after-free credits Zoom Offensive Security, the in-house team behind the 9.8-rated account takeover flaw the company patched in July. The startup’s post lists all three as its own findings, while acknowledging that Zoom already knew about the third and had filtered it server-side before the report arrived.
AI-Assisted Exploit Development
The firm’s account of the AI work is more complicated than its summary suggests. The first pass — an automated ranking of functions reachable from the Java layer — produced a queue of 3,762 functions across 70 libraries and missed the vulnerable library entirely, ranking it 45th. The relevant code surfaced only when researchers traced the running client through a live call, feature by feature. Levcovich writes that the barrier to building this class of exploit “has collapsed, and it will not come back.”
The disclosure follows OpenAI splitting its Daybreak program and releasing GPT-5.6-Cyber to vetted partners only, on the argument that offensive AI capability requires gating. A Security says it achieved its result using models available to anyone. By OpenAI’s own measure, its guardrailed public model answers 1.5% of advanced offensive-security prompts, compared to 95% for the restricted version — a gap that underscores the ongoing tension between open access and capability containment in AI-assisted security research.
