Zoom Patches Critical Zero-Click Vulnerabilities in Screen Sharing Feature

Zoom has released patches for four vulnerabilities in its annotation feature, allowing remote code execution without user interaction. The most critical flaw, CVE-2026-53413, has a CVSS score of 8.3 and enables attackers to execute code on another participant's device. Other vulnerabilities include CVE-2026-53414, rated 6.5, which could lead to denial-of-service attacks, and CVE-2026-53415, also rated 8.3. A Security, the research team that discovered these flaws, utilized AI tools to identify memory-safety issues in the annotation protocol. The affected systems include Zoom Workplace, Windows VDI Client, Zoom Rooms, and Zoom Meeting SDK. Users are advised to update to the latest versions to mitigate risks. The vulnerabilities were confirmed on August 11, 2026, coinciding with the patch release.

Key Points: • Zoom patched four vulnerabilities, including a critical zero-click flaw (CVE-2026-53413). • CVE-2026-53413 allows remote code execution without user interaction, posing a high risk. • Users are urged to update to the latest software versions to protect against these vulnerabilities.