Zoom Fixes AI-Assisted Screen-Sharing RCE Flaws
A Security disclosed three Zoom annotation vulnerabilities on August 11 that it said could let a meeting participant take over another participant’s device without a click. The firm said public AI models helped it find and exploit the flaws with fewer than 20 prompts; Zoom published security bulletins and fixes, including client updates through versions 7.1.5 and 7.0.6.
Zoom has fixed a set of annotation-protocol vulnerabilities that security researchers said could allow a participant in a meeting with screen sharing to execute code on another participant’s device. A Security publicly disclosed the work on August 11 after coordinating fixes with Zoom; the issues are tracked as CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415.
The vulnerable annotation path
The flaws were in the proprietary protocol Zoom clients use for real-time annotations during screen sharing. A Security said a malicious participant could send crafted annotation data that a receiving client would automatically parse. Its report describes a missing bounds check, an over-read and a separate unsafe pointer-handling path, with potential exploitation ranging from memory disclosure to remote code execution.
Zoom’s ZSB-26015 bulletin describes CVE-2026-53413 as a missing bounds check in the annotator function that may allow one meeting participant to achieve remote code execution on another participant’s device. Zoom rates that CVE High at 8.3 under CVSS 3.1. A Security used CVSS 4.0 and assigned critical 9.0 scores to the three vulnerabilities, so those severity figures are not directly interchangeable.
A Security said it confirmed the attack path across Zoom’s supported native platforms and reported the first vulnerability to Zoom in June. Its disclosure timeline says client-side fixes began shipping on June 22, a server-side mitigation followed on July 15, and an additional client fix shipped on July 20 before the August 11 public disclosure.
AI changed the research timeline
The researchers said they used publicly available AI models to map the closed-source attack surface, reverse the annotation protocol and develop a working exploit in fewer than 20 prompts and under 24 hours. WIRED independently reported the disclosure and the researchers’ account. The prompt count is A Security’s measurement, not an independently reproduced benchmark, but the technical report provides a detailed sequence of the reverse-engineering work.
The operational response is straightforward: update Zoom clients and enforce minimum versions for managed fleets. A Security says Zoom’s server-side filtering cannot inspect malicious annotation messages in end-to-end encrypted meetings, making current client versions especially important there. The broader lesson for security teams is that obscure parsers in widely deployed closed-source software may now be explored faster by both defenders and attackers, compressing the time available to patch and monitor.
Key Points
- 1A Security disclosed three Zoom annotation flaws that it said could enable zero-click remote code execution during a meeting.
- 2Zoom’s ZSB-26015 bulletin rates CVE-2026-53413 High at 8.3 and lists fixed client branches including 7.1.5 and 7.0.6.
- 3The researchers said public AI models helped produce a working exploit with fewer than 20 prompts in under 24 hours; that efficiency claim comes from A Security.
Scoring Rationale
The flaws affected a widely deployed collaboration platform and could enable cross-platform remote code execution with no victim click. Coordinated fixes reduce immediate exposure, while the researchers’ AI-assisted discovery timeline materially raises the defensive significance.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
