This vulnerability involves a missing bounds check in the annotator function of Zoom Clients, leading to a buffer over-read condition. An attacker who is a participant in a Zoom meeting can exploit this flaw remotely over the network to cause a denial of service against other participants. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and impact limited to availability (denial of service). No vendor advisory or patch information is currently available, and no affected versions are specified.

The impact is a denial of service condition against Zoom meeting participants caused by a buffer over-read in the annotator function. There is no impact on confidentiality or integrity. The disruption affects availability of the Zoom client for targeted users during meetings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with meeting participants and consider limiting annotation features or meeting participation to trusted users where possible.