“Zoomsday” flaws could let one Zoom participant attack another

Researchers disclosed three memory-safety vulnerabilities in Zoom's annotation parser (CVE-2026-53413, CVE-2026-53414, CVE-2026-53415) — dubbed “Zoomsday” — where a malicious meeting participant could send crafted collaboration data to crash clients, leak information, or achieve remote code execution; affected products include multiple Zoom Workplace, VDI, Rooms and Meeting SDK releases. The report highlights differing severity assessments (researchers: Critical; Zoom: High), and advises updating Zoom, restricting meeting access/features, and using anti-malware and device-management controls.