--- title: Zoom fixed three bugs that let anyone on a call take... description: Zoom patched three memory corruption flaws in its screen-share annotation feature that let any meeting participant, host or guest, execute code on another... canonical: https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zoom fixed three bugs that let anyone on a call take over your machine | daily.dev og:description: Zoom patched three memory corruption flaws in its screen-share annotation feature that let any meeting participant, host or guest, execute code on another... og:url: https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd og:image: https://api.daily.dev/og/posts/DhFssdegd.png og:image:alt: Zoom fixed three bugs that let anyone on a call take over your machine og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zoom fixed three bugs that let anyone on a call take over your machine **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments ## Summary Zoom patched three memory corruption flaws in its screen-share annotation feature that let any meeting participant, host or guest, execute code on another attendee's device with zero clicks and no visible indication. The fixes shipped in June and July 2026, about two months before public disclosure, in Zoom Workplace 7.1.5/7.0.6, Rooms and the Meeting SDK at 7.1.5, and the Windows VDI client at 7.0.11/6.6.16. A Security, which found the bugs, rated them 9.0/10, while Zoom rated CVE-2026-53413 and CVE-2026-53415 at 8.3 and CVE-2026-53414 at 6.5. The firm says it turned the flaws into a working exploit in under a day using fewer than 20 AI prompts, though its own automated scan missed the vulnerable library, ranking it 45th out of 3,762 functions — a human researcher found it by tracing a live call manually. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Zoom versions fix the annotation zero-click vulnerabilities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415? The fixes shipped in Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms and the Meeting SDK at 7.1.5, and the Windows VDI client at 7.0.11 and 6.6.16. These builds patch three memory corruption flaws in the annotation feature used during screen sharing that allowed zero-click code execution by any meeting participant. Versions older than these remain exposed. _Teams tracking client patch levels can follow security fixes like these on daily.dev._ ### How severe are the Zoom annotation vulnerabilities and who found them? A Security, the firm that discovered the three flaws, scored all of them 9.0 out of 10, while Zoom rated CVE-2026-53413 and CVE-2026-53415 at 8.3 and CVE-2026-53414 at 6.5. The bugs stemmed from a receiving client trusting network-supplied counts, allowing a buffer overrun and a return-address corruption, plus a dispatcher that didn't verify message senders. _daily.dev helps developers weigh vendor and researcher severity ratings when triaging disclosures._ ### Did AI actually discover the Zoom zero-click annotation bugs? No, a human researcher found the vulnerable library by manually tracing a live call after an automated ranking pass across 3,762 functions missed it, placing the vulnerable library 45th. AI was used afterward to turn the flaw into a working exploit in under a day using fewer than 20 prompts on publicly available models. _daily.dev keeps developers grounded on where AI actually helps versus hypes in vulnerability research._ ## Similar posts on daily.dev - [Zoom warns of critical account takeover vulnerability](https://daily.dev/posts/zoom-warns-of-critical-account-takeover-vulnerability-n5d4se3mt) · BleepingComputer · 1 upvotes · 0 comments - [Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws](https://daily.dev/posts/zoom-and-gitlab-release-security-updates-fixing-rce-dos-and-2fa-bypass-flaws-nu967rvz1) · The Hacker News · 0 upvotes · 0 comments - [TeamViewer urges users to patch severe flaws “as soon as possible”](https://daily.dev/posts/teamviewer-urges-users-to-patch-severe-flaws-as-soon-as-possible--crd5wid5c) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#zoom](https://daily.dev/tags/zoom) [View this post on daily.dev](https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zoom fixed three bugs that let anyone on a call take over your machine","url":"https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd"},"datePublished":"2026-08-12T14:22:59.744Z","dateModified":"2026-08-12T19:42:29.947Z","description":"Zoom patched three memory corruption flaws in its screen-share annotation feature that let any meeting participant, host or guest, execute code on another...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8f0cb9c0ad67d1c0d283a75e9aca594?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e8f0cb9c0ad67d1c0d283a75e9aca594?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,zoom","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Zoom fixed three bugs that let anyone on a call take over your machine"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zoom-fixed-three-bugs-that-let-anyone-on-a-call-take-over-your-machine-dhfssdegd#faq","mainEntity":[{"@type":"Question","name":"Which Zoom versions fix the annotation zero-click vulnerabilities CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415?","acceptedAnswer":{"@type":"Answer","text":"The fixes shipped in Zoom Workplace 7.1.5 and 7.0.6, Zoom Rooms and the Meeting SDK at 7.1.5, and the Windows VDI client at 7.0.11 and 6.6.16. These builds patch three memory corruption flaws in the annotation feature used during screen sharing that allowed zero-click code execution by any meeting participant. Versions older than these remain exposed. Teams tracking client patch levels can follow security fixes like these on daily.dev."}},{"@type":"Question","name":"How severe are the Zoom annotation vulnerabilities and who found them?","acceptedAnswer":{"@type":"Answer","text":"A Security, the firm that discovered the three flaws, scored all of them 9.0 out of 10, while Zoom rated CVE-2026-53413 and CVE-2026-53415 at 8.3 and CVE-2026-53414 at 6.5. The bugs stemmed from a receiving client trusting network-supplied counts, allowing a buffer overrun and a return-address corruption, plus a dispatcher that didn't verify message senders. daily.dev helps developers weigh vendor and researcher severity ratings when triaging disclosures."}},{"@type":"Question","name":"Did AI actually discover the Zoom zero-click annotation bugs?","acceptedAnswer":{"@type":"Answer","text":"No, a human researcher found the vulnerable library by manually tracing a live call after an automated ranking pass across 3,762 functions missed it, placing the vulnerable library 45th. AI was used afterward to turn the flaw into a working exploit in under a day using fewer than 20 prompts on publicly available models. daily.dev keeps developers grounded on where AI actually helps versus hypes in vulnerability research."}}]} ```