If you were in a Zoom call last month, someone in that meeting could have taken over your laptop without you clicking a single thing. That’s not a headline exaggeration. That’s what CVE-2026-53413, nicknamed “Zoomsday,” actually does.
Zoom fixed it on August 11, 2026. The patches came in Workplace versions 7.1.5 and 7.0.6, depending on your release branch, plus updates for the VDI Client, Zoom Rooms, and Meeting SDK. If you haven’t restarted Zoom since then, you’re probably still running a vulnerable copy.
Here’s the full story, what actually happened, and what you need to do about it today.
What Is the Zoomsday Vulnerability (CVE-2026-53413)?
CVE-2026-53413 is a missing bounds check in the annotator function of Zoom clients that allows a buffer over-write, letting a meeting participant achieve remote code execution on another participant’s device over the network. In plain English: someone in your meeting could send a corrupted message through Zoom’s drawing tool and run their own code on your machine. Zoom rated it high severity with a CVSS score of 8.3. Security AffairsMallory
The scary part isn’t just the code execution. It’s the “zero-click” part. The attacker could join or host a meeting, target any participant, and take over their machine with no action required from the victim and no visual cue that anything happened. No pop-up. No “allow this app” prompt. Nothing. Mallory
How Did the Zoomsday Bug Actually Work?
The flaw lived inside Zoom’s annotation feature — the tool people use to draw, highlight, or type over a shared screen during a call. The root cause was a missing bounds check during deserialization of annotation formatting data, in a code path called CAnnoFormatBlock::Deserialize, where attacker-controlled length fields were trusted when copying data into fixed-size buffers. GingerSec, LLC
Researchers at A Security put it more bluntly. They found four fixed 128-byte buffers that got filled after the parser read a 32-bit count sent over the wire — and nothing checked whether that count actually matched the buffer size. Send a bigger count than expected, and you overflow the buffer straight into adjacent memory. GridinSoft, LLC
Once memory is corrupted that way, an attacker can hijack the program’s control flow. The researchers demonstrated exploitation on macOS, where they corrupted control-flow data and executed code on the receiving system, with their proof of concept launching Safari on the victim’s machine. Opening Safari was the demo. A real attacker would swap that for malware, a backdoor, or a data exfiltration tool. Tenable
Who Found It, and Why Everyone’s Talking About the “AI” Angle
The vulnerability was discovered on June 8 by A Security senior vulnerability researcher Idan Levcovich while analyzing Zoom’s Android client, with a working exploit against Zoom 7.0.5 confirmed the following day. That’s a genuinely fast turnaround for a bug this serious. Tenable
A lot of coverage has run with the framing that AI “found” the exploit. What actually happened is more specific: A Security says the process of finding the flaw and building a working exploit used fewer than 20 prompts on publicly available AI models, completed in under 24 hours. That’s still impressive, but it’s a researcher using AI as a tool to speed up analysis, not an AI independently discovering and weaponizing a bug on its own. Worth knowing the difference before you repeat the headline. GridinSoft, LLC
The Timeline, Start to Finish
Here’s the part most coverage skips or scatters across three paragraphs.
- June 8-9: Bug found and exploit confirmed against Zoom 7.0.5.
- June 10: A Security reported the flaw to Zoom.
- June 22: Zoom began shipping client fixes.
- July 15: Zoom added a server-side mitigation. Server-side filtering alone couldn’t fully solve this, because it can’t inspect annotation traffic protected by end-to-end encryption.
- July 20: Zoom closed the related CVE-2026-53415 properly on the client side in version 7.1.5. GridinSoft, LLC
- August 11: Zoom published the public security bulletins for all three related vulnerabilities. GridinSoft, LLC
Two months from report to public disclosure is fairly standard for coordinated disclosure. It also means the fix existed weeks before most people heard the word “Zoomsday.”
Zoomsday Isn’t the Only Bug — Here’s How All Four Compare
Zoom’s August 11 bulletins covered more than just CVE-2026-53413. If you’re patching, patch for all of these at once.
| CVE | Nickname | Type | Severity | CVSS | What it does |
|---|---|---|---|---|---|
| CVE-2026-53413 | Zoomsday | Buffer overwrite | High | 8.3 | Remote code execution during a meeting, zero clicks needed |
| CVE-2026-53414 | — | Buffer over-read | Medium | 6.5 | Crashes another participant’s client (denial of service) |
| CVE-2026-53415 | — | Use-after-free | High | 8.3 | May also allow remote code execution |
| CVE-2026-53416 | — | Path traversal | High | not listed in sources | Affects VDI Client/Plugins, local file access outside intended directories |
A separate flaw, CVE-2026-53415, was also disclosed by A Security, though the firm learned after reporting it that Zoom had already found it independently through its own Offensive Security team.
One more thing worth flagging: this is a different bug from July’s Windows-only Zoom account-takeover issue, tracked as CVE-2026-53412, which affects different platforms through a different mechanism. Patching for one does not cover the other. CyberInsider
Is Zoom Safe to Use Now?
Yes, once you’re on a patched version. This wasn’t a design flaw baked into how Zoom fundamentally works — it was a specific coding mistake in one feature, and that mistake is fixed.
There’s no confirmed evidence of an actual attack campaign using this exploit before the patch, and the researchers didn’t report finding one in the wild. That’s the honest read: this was a serious, real bug, caught and fixed through responsible disclosure before it became a widespread problem. Not nothing, but not a five-alarm fire either — as long as you update. Tenable
What You Should Do Right Now
Don’t overthink this one. Do these three things:
- Update your Zoom client immediately. Get to Workplace version 7.1.5 or 7.0.6, Rooms 7.1.5, or Meeting SDK 7.1.5, depending on which product and branch you’re on. If you run the Windows VDI Client or VDI Plugins, update to version 7.0.11 or 6.6.16/6.6.15.
- Restart Zoom after updating, then confirm the version number in Zoom’s “About” or “Check for Updates” menu. Downloading an update doesn’t help if the app never restarted.
- If IT manages your Zoom install, push the update fleet-wide rather than waiting on individual users. This bug is exploitable purely through meeting participation, so one unpatched laptop in a call is enough exposure.
If a past meeting felt off and your device later showed odd behavior, don’t panic but don’t ignore it either. A vulnerable version proves exposure, not that someone actually used the exploit against you — but if a device later showed unexpected processes, new software, security alerts, or unusual camera or microphone activity, it’s worth preserving the meeting ID, time, participant list, and any Zoom logs before you run a security scan.
The Honest Takeaway
Zoomsday is a genuinely serious bug — an 8.3 CVSS, zero-click, code-execution flaw in software half the working world has open right now. It’s also already fixed, was responsibly disclosed, and doesn’t appear to have been used against anyone before the patch landed.
The real lesson isn’t “stop using Zoom.” It’s that a feature as ordinary as a drawing tool can become an attack surface, and update prompts you’re tempted to snooze are worth ten seconds of your time. Restart the app. Check the version number. Move on.
FAQ SECTION
Q1: What is CVE-2026-53413?
A1: It’s a missing bounds check in Zoom’s annotation function that allows a buffer over-write, letting a meeting participant remotely execute code on another participant’s device. Zoom nicknamed it “Zoomsday” internally after the researchers who found it. Security Affairs
Q2: Do I need to click anything to be affected by Zoomsday?
A2: No. The exploit required no action from the victim and showed no visible sign that anything had happened, as long as the attacker was in the same meeting. Mallory
Q3: Which Zoom version fixes CVE-2026-53413?
A3: Workplace 7.1.5 or 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 all contain the fix, along with VDI Client 7.0.11 or 6.6.16 for Windows. Update and restart Zoom, then check the version number.
Q4: Was the Zoomsday exploit used in real attacks?
A4: No confirmed attack campaign has been reported. A vulnerable version means exposure, not proof that anyone actually used the exploit against you.
Q5: Is Zoomsday the same bug as the July Zoom hacking issue?
A5: No. That was CVE-2026-53412, a separate Windows-only account-takeover flaw with a different mechanism and different affected platforms. Patching one doesn’t cover the other. CyberInsider
Q6: Did AI actually discover the Zoomsday vulnerability?
A6: A human researcher found it. A Security says AI tools helped speed up the process of finding the flaw and building a working exploit, using fewer than 20 prompts in under 24 hours, not that AI discovered it independently. GridinSoft, LLC
Q7: What are CVE-2026-53414, -53415, and -53416?
A7: CVE-2026-53414 is a medium-severity buffer over-read that can crash a participant’s client, CVE-2026-53415 is a high-severity use-after-free that may also allow code execution, and CVE-2026-53416 is a path traversal flaw affecting VDI Client and VDI Plugins. All were patched alongside Zoomsday on August 11.
