Full Report
Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's. The flaw sat in the annotation tool, the feature that lets participants draw and type on a shared screen, and it asked nothing of the victim beyond being in the meeting. No click, no download, no prompt, and nothing on screen to show it
Analysis Summary
# Vulnerability: Zoom Annotation Tool Remote Code Execution (RCE)
## CVE Details
- **CVE ID:** CVE-2026-53413, CVE-2026-53414, CVE-2026-53415
- **CVSS Score:** 8.3 (Vendor) / 9.0 (Researcher CVSS 4.0) (High/Critical)
- **CWE:** CWE-121 (Stack-based Buffer Overflow), CWE-125 (Buffer Over-read), CWE-416 (Use-After-Free)
## Affected Systems
- **Products:** Zoom Workplace, Zoom Workplace VDI Client (Windows), Zoom Rooms, and Zoom Meeting SDK.
- **Versions:**
- Zoom Workplace (All platforms): Before 7.1.5 and 7.0.6.
- Zoom Workplace VDI Client (Windows): Before 7.0.11 and 6.6.16.
- Zoom Rooms & Meeting SDK: Before 7.1.0 (7.1.5 for specific flaws).
- **Configurations:** Any meeting where the "Annotation" feature is enabled.
## Vulnerability Description
The flaws exist within Zoom's annotation tool, which allows participants to draw on a shared screen. Rather than sending images, the client transmits drawing instructions as structured objects (counts and data).
1. **Memory Corruption:** A receiver trusts the "count" field sent by the sender. By providing an oversized count, an attacker can overflow a fixed 128-byte buffer, overwriting the return address to achieve code execution.
2. **Logic/Origin Flaw:** The Zoom dispatcher fails to verify the sender's role. It treats incoming malicious drawing objects (0x10001) sent over the back-channel (meant for acknowledgments) as legitimate, allowing a viewer to attack a presenter or vice versa.
3. **Information Disclosure:** A buffer over-read allows an attacker to recover uninitialized heap memory, potentially leaking vtable pointers to bypass Address Space Layout Randomization (ASLR).
## Exploitation
- **Status:** PoC available (developed by "A Security" researchers); not currently known to be exploited in the wild.
- **Complexity:** Low (Zero-click; requires no interaction from the victim other than being in the meeting).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Potential for full system takeover and memory leaks).
- **Integrity:** High (Remote code execution allows for total system compromise).
- **Availability:** High (Can lead to client crashes or persistent backdoors).
## Remediation
### Patches
Users should update to the following versions or later:
- **Zoom Workplace:** 7.1.5 or 7.0.6 (depending on branch).
- **Zoom Workplace VDI (Windows):** 7.0.11 or 6.6.16.
- **Zoom Rooms/SDK:** 7.1.5.
### Workarounds
- **Disable Annotations:** Meeting hosts can disable the "Annotation" feature in Zoom settings to prevent the processing of these malformed objects.
- **Restrict Screen Sharing:** Limit sharing capabilities to "Host Only" to reduce the attack surface from participants.
## Detection
- **Indicators of Compromise:** Unusual network traffic patterns involving malformed drawing object types (0x10001) arriving from unexpected participant IDs.
- **Detection Methods:** Monitor for Zoom client crashes or unexpected child processes (e.g., `cmd.exe` or `powershell.exe`) spawned by the `Zoom.exe` process.
## References
- **Vendor Advisories:**
- hxxps[://]www[.]zoom[.]com/en/trust/security-bulletin/zsb-26015/
- hxxps[://]www[.]zoom[.]com/en/trust/security-bulletin/zsb-26016/
- hxxps[://]www[.]zoom[.]com/en/trust/security-bulletin/zsb-26017/
- **Researcher Technical Writeup:**
- hxxps[://]a[.]security/blog/asecurity-zoomsday