2026-08-22 · view entry permalink →
Zoomsday — the Zoom client build that closes the first two annotation flaws leaves the third open, and the national advisory that raised the alarm covers only one of the three
Belgium's Centre for Cybersecurity issued a Patch Immediately advisory on 2026-08-20 for CVE-2026-53413, stating that successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file (CCB, 2026-08-20). The flaw sits in the Zoom client's annotation feature. Zoom describes it as a missing bounds check in the annotator function that allows a buffer over-write, and the researcher who disclosed it published the mechanism: the deserializer reads a per-buffer character count as a 32-bit value taken straight off the wire into a fixed 128-byte buffer, with no bounds check to stop the count exceeding the buffer length (Zoom PSIRT, 2026-08-11; A Security, 2026-08-11). Zoom shipped the client fix on 2026-06-22 and a server-side mitigation on 2026-07-15, and disclosed publicly on 2026-08-11 (A Security, 2026-08-11). No party — not Zoom, not Belgium's CCB, not the researcher — reports exploitation in the wild.
The reason this is still worth an entry nine days after disclosure is a patch-floor split that a single combined version table hides. Zoom publishes one bulletin per identifier, and reading all three shows that the annotation component yielded a third flaw: CVE-2026-53415, a use-after-free in the same function, also scored 8.3, which Zoom describes in the same terms — a meeting participant achieving remote code execution on another participant (Zoom PSIRT, 2026-08-11). Its fixed-version table is higher than its siblings': Workplace, Rooms and the Meeting SDK at 7.1.5 rather than 7.1.0, and the Video SDK at 2.6.5 rather than 2.6.0 (Zoom PSIRT, 2026-08-11), against the 7.1.0 and 2.6.0 floors that close CVE-2026-53413 and the denial-of-service CVE-2026-53414 (Zoom PSIRT, 2026-08-11, Zoom PSIRT, 2026-08-11). An organisation that standardised on the 7.1.0 line — the version the widely reported CVE names — has closed two of the three and left the use-after-free open. Belgium's advisory does not surface this, because it addresses CVE-2026-53413 alone and never mentions the other two identifiers.
Two caveats belong on the record. Zoom's own CVSS vectors for both code-execution flaws carry UI:R, user interaction required, which contradicts the zero-click framing in the advisory's title and the researcher's own summary; no source explains the discrepancy, and this entry does not invent a reconciliation for it. And CCB's advisory carries the reminder that matters most for a two-month-old client bug: patching to the newest version may protect against future exploitation but does not remediate historic compromise (CCB, 2026-08-20).
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
Successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file.
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
Each count is a 32-bit value taken straight off the wire, and each buffer is a fixed 128 bytes. There is no bounds check to stop a count from exceeding the buffer length.
No click, no download, and nothing required of the victim but being in the meeting.