"Zoomsday": A Zero-Click Zoom RCE Chain Built With Fewer Than 20 Prompts to Public AI Models (CVE-2026-53413)

Zoom Workplace clients across supported desktop and mobile platforms, via the meeting annotation protocol

Zoom patched three annotation memory-corruption flaws disclosed on August 11, 2026 by vendor A Security under the name Zoomsday: CVE-2026-53413 (CVSS 8.3), CVE-2026-53414, and CVE-2026-53415. The lead flaw is a buffer over-write caused by a missing bounds check in the text annotation deserialization logic, which allocated fixed 128-byte buffers without validating input length. Any participant in a meeting can compromise every other participant: the receiving client parses the crafted annotation message automatically, with no click and no visible compromise warning. The researchers reported building the full working exploit chain in under 24 hours using fewer than 20 prompts to publicly available AI models, with no privileged access and no specialized offensive tooling

A missing length check on attacker-controlled input, the same class of memory-safety defect that has existed for decades. What changed is the cost of turning it into a working zero-click chain, which the research puts at under a day and fewer than 20 prompts to models anyone can use, against a product with hundreds of millions of users