Zoom has started rolling out patches for several security issues in its products, including a severe zero-click RCE vulnerabilities flaw that can lead to remote code execution. The updates affect Zoom clients across all supported platforms, with the most serious problems linked to a specific feature used during meetings.
According to a security firm that reported the issues, the core risk comes from how the Zoom client processes information for its annotator feature. Because the underlying logic can automatically parse incoming data, an attacker does not need to trick a victim into taking a specific action once the exploit message is delivered.
What Zoom fixed in its latest patch rollout
Zoom’s announcement focuses on multiple vulnerabilities addressed through coordinated client updates and, in some cases, server-side mitigation. In total, Zoom’s updates cover four CVEs named by the researcher, with three of the most impactful findings tied to the annotator function.
The company stated that patched releases are available for Workplace and Rooms editions, as well as for Meeting SDK components, covering supported platforms.
The most severe issue: CVE-2026-53413
The most critical problem is identified as CVE-2026-53413. This vulnerability involves memory corruption that could allow a meeting participant to execute code on another participant’s machine.
The researcher explained that exploitation relies on the way Zoom clients automatically parse what they receive. By sending a carefully crafted message, an attacker could corrupt the recipient client’s memory and cause code execution.
The report also notes why this can be particularly dangerous in real meeting scenarios. The proprietary protocol used by the annotator function can create a direct communication channel between a viewer and a sharer. That design enables targeting of individuals in a meeting rather than only affecting a session at large.
In the described scenario, an attacker can either join or host a meeting, select a target participant, and take control of that participant’s machine without requiring the victim to perform an action. The researcher further stated there is no visual indication that the compromise occurred.
Additional annotator bugs: CVE-2026-53414 and CVE-2026-53415
Zoom also addressed CVE-2026-53414, another flaw located in the annotator feature. This issue stems from a missing bounds check in text annotator handling. As a result, an attacker could send crafted messages that lead to a buffer overread, enabling a denial-of-service style impact.
Beyond causing disruption, the report indicates that an attacker can target meeting participants with a DoS attack by leveraging the same annotator processing pathway.
The firm additionally identified CVE-2026-53415, a use-after-free vulnerability in the annotator function. However, the firm reported that by the time they disclosed it, Zoom had already discovered the problem internally.
Why these were considered “zero-click” risks
The term zero-click RCE vulnerabilities is used because the attack does not require the victim to click something or perform a specific interaction at the moment of compromise. The core factor is the automatic processing performed by the Zoom client.
In the described findings, exploitation works by delivering a malicious message through the annotator’s proprietary protocol. Because every client parses the received content, the attacker’s payload can trigger memory safety failures and lead to code execution without needing user confirmation.
From a defender’s perspective, this means the threat model is broader than typical phishing or social-engineering attacks. It also increases the importance of timely installation of fixes and any related server mitigations.
Patch versions and what was updated
Zoom’s Tuesday release included fixes for the three annotator-related vulnerabilities on a variety of components. The company’s updates cover client apps and SDK-related releases across supported platforms.
For the Workplace product line, Zoom said versions 7.1.5 and 7.0.6 include fixes. For Rooms, version 7.1.5 is listed. Additionally, the Meeting SDK update is described as version 7.1.5 for all supported platforms.
VDI client and plugin updates
Beyond the standard apps, Zoom also rolled out patches for Workplace VDI components. For Windows environments, Zoom cited updates to:
- Workplace VDI Client versions 7.0.11 and 6.6.16
- Workplace VDI Plugins versions 7.0.11 and 6.6.15
These VDI updates include fixes for CVE-2026-53416, which the researcher described as a path traversal issue that could lead to information disclosure.
Coordinated disclosure and server-side mitigation
A key part of the publication timeline involved ensuring customers would have time to deploy both the client-side patch and the relevant server-side mitigation. The security firm indicated that because a zero-click RCE scenario requires no user action, they prioritized a coordinated window before releasing details publicly.
Zoom’s patch rollout aligns with this approach, providing updates that address the vulnerabilities and reducing the window in which affected clients might remain exposed.
Where to find more resolved-vulnerability details
Zoom indicated that additional information about the resolved issues is available on its security bulletin page. Organizations that manage Zoom deployments may want to review those bulletins to confirm which versions are affected and ensure their update strategy matches the platforms they use.
What users and IT teams should do now
Even if your organization uses Zoom only occasionally, the potential impact of zero-click RCE vulnerabilities makes patching urgent. If you administer endpoints, prioritize upgrading Zoom clients and SDK components to the fixed versions mentioned in the rollout.
For VDI environments, check whether the Workplace VDI client and plugins versions in your infrastructure match the patched releases. Because path traversal issues can affect information exposure, ensuring VDI components are updated is also important.
Finally, keep an eye on Zoom’s security communications for confirmation of which CVEs are covered by each release and whether any additional mitigation guidance applies to your setup.
Conclusion
Zoom’s latest updates respond to multiple vulnerabilities, including one severe issue that could enable remote code execution through a zero-click mechanism. The fixes target critical memory corruption and other annotator-related weaknesses, along with an additional path traversal flaw impacting VDI setups. By moving quickly to install the patched versions—Workplace, Rooms, Meeting SDK, and VDI components—organizations can reduce exposure to zero-click RCE vulnerabilities and limit the potential for attacker-controlled outcomes.
Source: https://www.securityweek.com/zoom-patches-zero-click-code-execution-vulnerability/
