This vulnerability is a use-after-free (CWE-416) in the annotator function of Zoom Clients. It could enable a remote attacker, who is a participant in a Zoom meeting, to execute arbitrary code on another participant's client by exploiting the flaw over the network. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability, but the attack complexity is high and user interaction is required. No vendor remediation or patch details are currently available, and no known exploits have been reported.

Successful exploitation could lead to remote code execution on the victim's Zoom client, compromising confidentiality, integrity, and availability of the affected system. This could allow an attacker to take control of the victim's device within the context of the Zoom meeting application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when joining meetings with untrusted participants and consider limiting annotation privileges. Monitor Zoom's official channels for updates and apply patches promptly once released.