Flaws in Zoom Annotation Could Let Attendees Take Over Others’ Clients
Security researchers disclosed three Zoom annotation flaws that could let a meeting participant hijack another attendee’s or the presenter’s Zoom client via crafted screen drawings. Patches were released in June–July before the disclosure, and there are no known exploits in the wild. The vulnerabilities span a buffer over-write, a buffer over-read, and a use-after-free (CVE-2026-53413, -53414, -53415) with disputed CVSS scores between researchers and Zoom, and conflicting claims about whether user interaction is required. Zoom lists its own CVEs with different scoring and credits, while the research firm claims a rapid exploit path using public AI models.