Three vulnerabilities, collectively dubbed "Zoomsday" by researchers, have been identified in the Zoom meeting platform. These flaws, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, could enable one participant in a Zoom meeting to compromise another through specially crafted collaboration data.
The vulnerabilities reside in the code responsible for processing annotation data shared during meetings. When a Zoom client receives structured data from another participant for display, such as drawings or text boxes, the underlying annotation parser contained several memory-safety bugs. These bugs could lead to issues if the software fails to properly validate lengths, counts, and references of incoming data.
Successful exploitation of these flaws could result in a vulnerable client crashing, leaking information, or even executing attacker-controlled code. The affected applications include Zoom Workplace on all supported platforms prior to versions 7.1.5 and 7.0.6, the Zoom Workplace VDI Client for Windows before versions 7.0.11 and 6.6.16, Zoom Rooms on all supported platforms before version 7.1.5, and the Zoom Meeting SDK on all supported platforms before version 7.1.5.
While researchers rated these vulnerabilities as Critical, Zoom assigned them a High severity rating. This discrepancy appears to stem from differing interpretations under the Common Vulnerability Scoring System (CVSS). Zoom considers successful exploitation to require user interaction, specifically that an attacker would need to persuade a target to join a meeting with the intent to compromise their machine.
To mitigate these risks, Zoom has released a security bulletin detailing the necessary updates. Users are advised to update their Zoom applications to the latest versions as soon as possible. Organizations should also ensure their device management tools are configured to deliver updates to all deployed Zoom clients.
Beyond updating, users can enhance their security by restricting who can join meetings. This includes implementing passcodes, utilizing waiting rooms, enabling authenticated-user restrictions, and using unique meeting links for sensitive discussions. Furthermore, if features like annotation, whiteboards, remote control, file transfer, or third-party applications are not essential, particularly for open invitation meetings, disabling them is recommended. While a single meeting crash might not indicate an attack, recurring crashes warrant further investigation.
