The vulnerability CVE-2026-53413 affects Zoom's annotation feature, specifically its proprietary protocol that opens a direct channel between meeting participants. A missing bounds check in the text annotator allows specially crafted messages to corrupt the receiving client's memory, enabling remote code execution without any required user action or visual cues. Additional related vulnerabilities include CVE-2026-53414, a buffer overread leading to denial-of-service, and CVE-2026-53415, a use-after-free flaw. Zoom has patched these issues in Workplace versions 7.1.5 and 7.0.6, Rooms version 7.1.5, Meeting SDK version 7.1.5, and Workplace VDI Client and Plugins versions 7.0.11 and 6.6.x. The zero-click nature of the RCE means attackers can compromise machines simply by joining or hosting a meeting.

An attacker who is a participant in a Zoom meeting can exploit the zero-click RCE vulnerability to execute arbitrary code on other participants' machines without any interaction or indication from the victim. This can lead to full compromise of the targeted machines. The related buffer overread vulnerability can cause denial-of-service conditions. These vulnerabilities affect all supported Zoom client platforms using the annotation feature.

Zoom has released official patches addressing these vulnerabilities in multiple client versions, including Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, Meeting SDK 7.1.5, and Workplace VDI Client and Plugins 7.0.11 and 6.6.x. Users and administrators should apply these updates promptly. Since the vulnerabilities are patched, no additional mitigation steps are required beyond updating to the fixed versions.