Zoomsday; the Zoom client build that closes the first two annotation flaws leaves the third open, and the national advisory that raised the alarm covers only one of the three
A fleet standardised on Workplace 7.1.0 is patched against two of these CVEs and exposed to the use-after-free
Defender actions
- Raise the enforced Zoom client floor to Workplace 7.1.5, Rooms 7.1.5, Meeting SDK 7.1.5 and Video SDK 2.6.5, not the 7.1.0 / 2.6.0 build that closes only CVE-2026-53413 and CVE-2026-53414. Check managed and kiosk-style deployments separately from user endpoints: Zoom Rooms units in meeting spaces and VDI clients are the ones least likely to have taken an automatic update.
Analysis
Belgium's Centre for Cybersecurity issued a Patch Immediately advisory on 2026-08-20 for CVE-2026-53413, stating that successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file (CCB, 2026-08-20). The flaw sits in the Zoom client's annotation feature. Zoom describes it as a missing bounds check in the annotator function that allows a buffer over-write, and the researcher who disclosed it published the mechanism: the deserializer reads a per-buffer character count as a 32-bit value taken straight off the wire into a fixed 128-byte buffer, with no bounds check to stop the count exceeding the buffer length (Zoom PSIRT, 2026-08-11; A Security, 2026-08-11). Zoom shipped the client fix on 2026-06-22 and a server-side mitigation on 2026-07-15, and disclosed publicly on 2026-08-11 (A Security, 2026-08-11). No party (not Zoom, not Belgium's CCB, not the researcher) reports exploitation in the wild.
The reason this is still worth an entry nine days after disclosure is a patch-floor split that a single combined version table hides. Zoom publishes one bulletin per identifier, and reading all three shows that the annotation component yielded a third flaw: CVE-2026-53415, a use-after-free in the same function, also scored 8.3, which Zoom describes in the same terms, a meeting participant achieving remote code execution on another participant (Zoom PSIRT, 2026-08-11). Its fixed-version table is higher than its siblings': Workplace, Rooms and the Meeting SDK at 7.1.5 rather than 7.1.0, and the Video SDK at 2.6.5 rather than 2.6.0 (Zoom PSIRT, 2026-08-11), against the 7.1.0 and 2.6.0 floors that close CVE-2026-53413 and the denial-of-service CVE-2026-53414 (Zoom PSIRT, 2026-08-11, Zoom PSIRT, 2026-08-11). An organisation that standardised on the 7.1.0 line (the version the widely reported CVE names) has closed two of the three and left the use-after-free open. Belgium's advisory does not surface this, because it addresses CVE-2026-53413 alone and never mentions the other two identifiers.
Two caveats belong on the record. Zoom's own CVSS vectors for both code-execution flaws carry UI:R, user interaction required, which contradicts the zero-click framing in the advisory's title and the researcher's own summary; no source explains the discrepancy, and this entry does not invent a reconciliation for it. And CCB's advisory carries the reminder that matters most for a two-month-old client bug: patching to the newest version may protect against future exploitation but does not remediate historic compromise (CCB, 2026-08-20).
Cited evidence
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
Successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file.
While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.
Each count is a 32-bit value taken straight off the wire, and each buffer is a fixed 128 bytes. There is no bounds check to stop a count from exceeding the buffer length.
No click, no download, and nothing required of the victim but being in the meeting.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.