Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution

Zoom patched a critical zero-click remote code execution vulnerability (CVE-2026-53413, dubbed “Zoomsday”) in its annotation feature that allowed a meeting participant to execute code on other participants' devices across all supported platforms; researchers also identified additional memory-corruption issues (CVE-2026-53414, CVE-2026-53415). The flaw is a wire-controlled stack buffer overflow in CAnnoFormatBlock::Deserialize that can be triggered via Zoom’s normal encrypted transport without user interaction, enabling RCE, data theft, camera/microphone activation, and large-scale exposure; Zoom has released client updates (Workplace 7.1.5/7.0.6, Rooms 7.1.5, Meeting SDK 7.1.5) to remediate the issues.