---
schema: 1
kind: vulnerability
title: "Zoomsday — the Zoom client build that closes the first two annotation flaws leaves the third open, and the national advisory that raised the alarm covers only one of the three"
headline: "A fleet standardised on Workplace 7.1.0 is patched against two of these CVEs and exposed to the use-after-free"
summary: >
  Belgium's Centre for Cybersecurity issued a Patch Immediately advisory on 2026-08-20 for CVE-2026-53413,
  a missing bounds check in the Zoom client's annotation deserializer that lets one meeting participant
  reach code execution on another's device. Reading Zoom's own three per-CVE bulletins shows the patch
  story is not what a single combined version table implies: CVE-2026-53413 and CVE-2026-53414 are closed
  by Workplace 7.1.0 and Video SDK 2.6.0, but the third flaw in the same component, the use-after-free
  CVE-2026-53415, needs 7.1.5 and 2.6.5 — so a fleet standardised on the 7.1.0 line is still exposed.
  Belgium's advisory names only the first CVE. No party reports in-the-wild exploitation, and Zoom's own
  CVSS vectors record user interaction as required, which sits in unresolved tension with the zero-click
  framing used by the advisory title and the discovering researcher.
discovered_at: "2026-08-22T05:03:00Z"
event_date: "2026-08-11"
run_id: 2026-08-22T0410Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, dos, patch-available]
regions: [europe, global]
sectors: [public-sector, healthcare, education]
entities: []
techniques: [T1203]
affected_products: ["Zoom Workplace", "Zoom Workplace VDI Client for Windows", "Zoom Rooms", "Zoom Meeting SDK", "Zoom Video SDK"]
cves:
  - id: CVE-2026-53413
    cvss: "8.3"
    epss: null
    type: memory-corruption
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "Zoom Workplace before 7.1.0 and 7.0.6; VDI Client for Windows before 7.0.11 and 6.6.16; Zoom Rooms before 7.1.0; Meeting SDK before 7.1.0; Video SDK before 2.6.0"
    fixed: "Zoom Workplace 7.1.0 / 7.0.6; VDI Client 7.0.11 / 6.6.16; Rooms 7.1.0; Meeting SDK 7.1.0; Video SDK 2.6.0"
  - id: CVE-2026-53414
    cvss: "6.5"
    epss: null
    type: dos
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "same product and version set as CVE-2026-53413"
    fixed: "Zoom Workplace 7.1.0 / 7.0.6; VDI Client 7.0.11 / 6.6.16; Rooms 7.1.0; Meeting SDK 7.1.0; Video SDK 2.6.0"
  - id: CVE-2026-53415
    cvss: "8.3"
    epss: null
    type: memory-corruption
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "Zoom Workplace before 7.1.5 and 7.0.6; VDI Client for Windows before 7.0.11 and 6.6.16; Zoom Rooms before 7.1.5; Meeting SDK before 7.1.5; Video SDK before 2.6.5"
    fixed: "Zoom Workplace 7.1.5 / 7.0.6; VDI Client 7.0.11 / 6.6.16; Rooms 7.1.5; Meeting SDK 7.1.5; Video SDK 2.6.5"
sources:
  - url: "https://www.zoom.com/en/trust/security-bulletin/ZSB-26017/"
    publisher: "Zoom PSIRT (ZSB-26017)"
    date: "2026-08-11"
    role: primary
  - url: "https://www.zoom.com/en/trust/security-bulletin/ZSB-26015/"
    publisher: "Zoom PSIRT (ZSB-26015)"
    date: "2026-08-11"
    role: primary
  - url: "https://www.zoom.com/en/trust/security-bulletin/ZSB-26016/"
    publisher: "Zoom PSIRT (ZSB-26016)"
    date: "2026-08-11"
    role: primary
  - url: "https://ccb.belgium.be/advisories/warning-zero-click-remote-code-execution-zoom-clients-patch-immediately"
    publisher: "Centre for Cybersecurity Belgium"
    date: "2026-08-20"
    role: primary
  - url: "https://a.security/blog/asecurity-zoomsday"
    publisher: "A Security"
    date: "2026-08-11"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access."
    publisher: "Zoom PSIRT (ZSB-26015)"
  - quote: "Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access."
    publisher: "Zoom PSIRT (ZSB-26017)"
  - quote: "Successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file."
    publisher: "Centre for Cybersecurity Belgium"
  - quote: "While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise."
    publisher: "Centre for Cybersecurity Belgium"
  - quote: "Each count is a 32-bit value taken straight off the wire, and each buffer is a fixed 128 bytes. There is no bounds check to stop a count from exceeding the buffer length."
    publisher: "A Security"
  - quote: "No click, no download, and nothing required of the victim but being in the meeting."
    publisher: "A Security"
verification: multi-source
sourcing_note: >
  Three source-level discrepancies are carried rather than reconciled, because no cited source resolves
  any of them. First, Zoom's own CVSS vectors for both code-execution flaws record UI:R, user interaction
  required, while Belgium's advisory is titled for a zero-click flaw and the discovering researcher writes
  that nothing is required of the victim but being in the meeting; the `vector` field follows the vendor's
  own scored vector because that is the assessment the CVE travels with, and the disagreement is stated in
  the body rather than resolved. Second, Belgium's advisory covers only CVE-2026-53413 — the other two
  identifiers do not appear in it at all — so it is not cited here for anything concerning them. Third,
  provenance for CVE-2026-53415 is contradicted three ways: Zoom's bulletin credits its own offensive
  security team, while the researcher's write-up says in its summary that Zoom had already found and fixed
  it before their report and says in its detailed section that their own research surfaced it and names
  their own researcher; the entry therefore attributes the flaw to no one. The event date records the
  2026-08-11 public disclosure, not the in-window national advisory that surfaced it here.
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Raise the enforced Zoom client floor to Workplace 7.1.5, Rooms 7.1.5, Meeting SDK 7.1.5 and Video SDK 2.6.5 — not the 7.1.0 / 2.6.0 build that closes only CVE-2026-53413 and CVE-2026-53414. Check managed and kiosk-style deployments separately from user endpoints: Zoom Rooms units in meeting spaces and VDI clients are the ones least likely to have taken an automatic update."
migrated_from: null
---

Belgium's Centre for Cybersecurity issued a Patch Immediately advisory on 2026-08-20 for CVE-2026-53413, stating that successful exploitation could allow an attacker participating in a meeting to execute arbitrary code on another participant's device, without requiring them to click a malicious link or download a file ([CCB, 2026-08-20](https://ccb.belgium.be/advisories/warning-zero-click-remote-code-execution-zoom-clients-patch-immediately)). The flaw sits in the Zoom client's annotation feature. Zoom describes it as a missing bounds check in the annotator function that allows a buffer over-write, and the researcher who disclosed it published the mechanism: the deserializer reads a per-buffer character count as a 32-bit value taken straight off the wire into a fixed 128-byte buffer, with no bounds check to stop the count exceeding the buffer length ([Zoom PSIRT, 2026-08-11](https://www.zoom.com/en/trust/security-bulletin/ZSB-26015/); [A Security, 2026-08-11](https://a.security/blog/asecurity-zoomsday)). Zoom shipped the client fix on 2026-06-22 and a server-side mitigation on 2026-07-15, and disclosed publicly on 2026-08-11 ([A Security, 2026-08-11](https://a.security/blog/asecurity-zoomsday)). No party — not Zoom, not Belgium's CCB, not the researcher — reports exploitation in the wild.

The reason this is still worth an entry nine days after disclosure is a patch-floor split that a single combined version table hides. Zoom publishes one bulletin per identifier, and reading all three shows that the annotation component yielded a third flaw: CVE-2026-53415, a use-after-free in the same function, also scored 8.3, which Zoom describes in the same terms — a meeting participant achieving remote code execution on another participant ([Zoom PSIRT, 2026-08-11](https://www.zoom.com/en/trust/security-bulletin/ZSB-26017/)). Its fixed-version table is higher than its siblings': Workplace, Rooms and the Meeting SDK at 7.1.5 rather than 7.1.0, and the Video SDK at 2.6.5 rather than 2.6.0 ([Zoom PSIRT, 2026-08-11](https://www.zoom.com/en/trust/security-bulletin/ZSB-26017/)), against the 7.1.0 and 2.6.0 floors that close CVE-2026-53413 and the denial-of-service CVE-2026-53414 ([Zoom PSIRT, 2026-08-11](https://www.zoom.com/en/trust/security-bulletin/ZSB-26015/), [Zoom PSIRT, 2026-08-11](https://www.zoom.com/en/trust/security-bulletin/ZSB-26016/)). An organisation that standardised on the 7.1.0 line — the version the widely reported CVE names — has closed two of the three and left the use-after-free open. Belgium's advisory does not surface this, because it addresses CVE-2026-53413 alone and never mentions the other two identifiers.

Two caveats belong on the record. Zoom's own CVSS vectors for both code-execution flaws carry `UI:R`, user interaction required, which contradicts the zero-click framing in the advisory's title and the researcher's own summary; no source explains the discrepancy, and this entry does not invent a reconciliation for it. And CCB's advisory carries the reminder that matters most for a two-month-old client bug: patching to the newest version may protect against future exploitation but does not remediate historic compromise ([CCB, 2026-08-20](https://ccb.belgium.be/advisories/warning-zero-click-remote-code-execution-zoom-clients-patch-immediately)).

**Defender takeaway:** the vulnerable code runs inside the client, reached over Zoom's own encrypted transport, so there is nothing to see at the network layer and no signature to write — the control is the enforced version floor, and the floor most estates will have set is the wrong one. Where detection is possible it is on the endpoint and it is coarse: crash, exception and fault-reporting telemetry from Zoom client processes during active meetings, and any child process spawned by a Zoom client process, which is not something a conferencing client does in normal operation. **Triage:** Zoom clients crash for ordinary reasons — driver faults, resource exhaustion on thin VDI images, codec problems — so a crash alone discriminates nothing. What separates this from routine instability is a crash that occurs during an active meeting with an external participant present, on a client below the 7.1.5 floor, and above all one followed by process creation under the Zoom client rather than by a clean restart. Kiosk-style deployments deserve separate attention: a Zoom Rooms unit in a government meeting space cannot be socially engineered into caution, and is also the device least likely to have taken an unattended update.