Zoom annotation flaws disclosed Tuesday could allow a participant in a live meeting to remotely execute code on another attendee's device. Zoom published three August 11 security bulletins covering CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415 after coordinating fixes with A Security, whose researchers described the attack as requiring no click or download from the targeted attendee.

The flaws affect the annotation engine used to draw text, shapes and other marks over shared screens or whiteboards. Zoom assigned CVE-2026-53413 a high-severity CVSS score of 8.3 and said a missing bounds check can permit a meeting participant to achieve remote code execution over the network. The company credited A Security researcher Idan Levcovich with reporting the issue.

A Security said the engine automatically deserializes annotation messages sent through Zoom's proprietary protocol. Its analysis found that CVE-2026-53413 lets an attacker-controlled character count cause data to be copied beyond fixed 128-byte buffers. The researchers demonstrated control of execution on macOS and said shared annotation code made the vulnerable parsing path reachable across Zoom's native client platforms.

The related CVE-2026-53414 is a medium-severity buffer over-read that Zoom says can let one meeting participant cause a denial of service for another. CVE-2026-53415 is a high-severity use-after-free flaw in the same annotator component that Zoom says may also permit remote code execution. A Security reported finding the first flaws in June and publicly disclosed the research on August 11 after client and server protections were deployed.

Zoom lists Workplace clients on all supported platforms before versions 7.1.5 and 7.0.6 in their respective branches as affected. The affected list also includes Windows VDI clients before 7.0.11 and 6.6.16. For Zoom Rooms and the Meeting SDK, version 7.1.5 fixes all three flaws, while version 7.1.0 addresses CVE-2026-53413 and CVE-2026-53414. Zoom advises users to install the latest available updates.

A Security said Zoom deployed a server-side filter for malicious annotation traffic in older clients, but warned that the filter cannot inspect end-to-end encrypted meetings. Organizations should therefore verify client versions rather than rely on the server mitigation, enforce minimum supported releases where possible, and consider restricting annotation until managed endpoints and meeting-room systems are updated.