Most security bugs need you to click something, download something, or approve something before an attacker gets in. A set of Zoom vulnerabilities disclosed in August 2026, nicknamed “Zoomsday,” didn’t need any of that. Simply being in a Zoom call where screen sharing was active, as host or participant, was enough to expose your device to complete remote takeover from another attendee, with no visible warning that anything was happening.
Why This One Is Different From a Normal Bug
Most exploits require some action from the victim: opening an attachment, clicking a link, approving a permission prompt. This one required none of that, which is what makes it a genuine “zero-click” vulnerability rather than just a serious bug. The flaw lived in the protocol Zoom’s annotation feature uses to exchange drawing and text data directly between whoever’s sharing their screen and everyone watching. A malicious participant could send malformed annotation data through that channel and execute code on another attendee’s device without them clicking, downloading, or approving anything, and without any visible sign it had happened.
The specific technical fault was a memory-safety problem in the routine that processes text-formatting data sent through that annotation channel, tracked as CVE-2026-53413 and rated “high” severity by Zoom’s own security team. Two related flaws, CVE-2026-53414 and CVE-2026-53415, affect the same annotation-processing code and were patched in the same release.
What “Memory-Safety Problem” Means Here
The specific fault sat in a routine called `CAnnoFormatBlock::Deserialize`, the code responsible for taking incoming text-formatting data from the annotation channel and turning it back into something the app can use. “Deserialize” is the technical term for that translation step, and it’s a classic place for this category of bug to hide: the code has to trust that the incoming data is shaped the way it expects, and if a malicious sender crafts data that violates those assumptions in the right way, the processing code can be tricked into writing data outside the memory it was supposed to stay inside. That’s what “memory-safety problem” means in practice, and it’s the same general category of flaw responsible for a large share of the most severe security vulnerabilities across all kinds of software, not something unique to Zoom’s implementation.
The reason this specific channel was so dangerous is that it’s designed to accept and process real-time data from other meeting participants by default, the entire point of a shared annotation feature. A vulnerability in code that’s supposed to process untrusted input from strangers, which is exactly what a Zoom call participant is, is a categorically worse place for a memory-safety bug to live than one buried in a feature only the local user ever touches.
How This Got Found So Fast
The researchers who found it, a team called A Security, used publicly available AI models to identify the flaws and build a working exploit in fewer than 20 commands. That’s worth sitting with for a second: the barrier to finding and weaponizing a bug like this is dropping fast, which is less a statement about Zoom specifically and more a reason to treat “someone will eventually find this” as a much shorter timeline than it used to be for any widely used software.
Under 20 Commands Is the Number That Should Worry You
It’s worth being specific about what “fewer than 20 commands” actually represents, since it’s easy to read past as a vague technical detail. Finding a genuine zero-click, remote-code-execution vulnerability in production software used to be specialist work, requiring deep manual code review, extensive reverse-engineering, and often weeks or months of dedicated effort by researchers with specific expertise. A process that takes fewer than 20 AI-assisted commands to go from nothing to a working exploit compresses that timeline dramatically, and it doesn’t require the person driving it to have that same depth of specialist background.
That doesn’t mean every piece of software is suddenly one afternoon away from a critical exploit. It does mean the population of people capable of finding and weaponizing this category of bug is growing faster than it used to, which is a real, structural reason to expect similar disclosures more often going forward, not a one-time coincidence specific to Zoom’s codebase.
Every Platform, Not Just One
This affected Zoom clients across Windows, macOS, Linux, iOS, and Android, so switching platforms wasn’t a workaround while this was live. Affected versions were Zoom Workplace clients before 7.1.5 or 7.0.6 depending on the release branch, along with older VDI Client, Zoom Rooms, and Meeting SDK builds generally. If you’re on an older installed version and haven’t updated recently, this is exactly the kind of gap that matters, regardless of which operating system you’re on.
The Fix, Specifically
Zoom shipped fixes for all three vulnerabilities in Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, and Meeting SDK version 7.1.5 across all supported platforms. Checking your version and updating through Zoom’s own update mechanism, or your app store on mobile, is the fix, since the flaw is in code that runs whenever the annotation feature processes data during screen sharing.
A Pattern Worth Noticing, Not Just This One Bug
This is the second zero-click, screen-sharing-related vulnerability disclosed around the same period; Apple’s own Screen Sharing tool had a comparable authentication-bypass flaw patched the same month. Two unrelated platforms hitting a similar category of bug in close succession isn’t proof of a coordinated problem, but it is a reasonable signal that screen-sharing and annotation features, tools built specifically to hand one participant real-time access to what’s happening on another device, are an attractive and increasingly scrutinized target right now.
That’s a good reason to treat update notifications for any video-conferencing or remote-access tool as something to act on promptly rather than defer, not just for Zoom specifically. The tools built to make remote collaboration seamless are, by design, sitting closer to the kind of system access a genuine security bug can turn against you than most other everyday software is.
What to Actually Do Before Your Next Call
Two concrete steps cover this specific issue:
- Check your Zoom version now, not before your next scheduled call. Zoom Workplace should be at 7.1.5 or 7.0.6 or newer depending on your release branch; older VDI Client, Rooms, or Meeting SDK installs need updating to their latest available version too.
- Update on every device you use Zoom on, not just your primary computer. This affected Windows, macOS, Linux, iOS, and Android alike, so a patched desktop client with an unpatched phone app still leaves a real gap.
Neither step takes more than a couple of minutes, and given that the exploit required no action from you at all to work, patching is the only real defense available here.
*Sources: Ubergizmo — “Zoom’s Critical ‘Zoomsday’ Vulnerability Allows Unauthorized Remote Control”; CVE numbers and exact patch versions cross-checked against Malwarebytes’ coverage of the same disclosure.*
