A Vulnerability in Zoom Clients Could Allow for Remote Code Execution

A vulnerability has been discovered in Zoom Clients that could allow for remote code execution. Zoom is a cloud-based communications platform that allows users to connect via video, audio, chat, and content sharing. Successful exploitation could allow an attacker to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.

There are currently no reports of this vulnerability being exploited in the wild. Open source articles have dubbed this vulnerability as "Zoomsday", highlighting the critical impact of exploitation.

A vulnerability has been discovered in Zoom Clients that could allow for remote code execution. Details of the vulnerability are as follows:

Tactic: Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

* Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access. Attackers could join or host a Zoom meeting and silently take control of participants’ devices without any user interaction. Once compromised, they could steal data, activate microphones or cameras, or install malware. In large meetings, a single malicious message could expose multiple participants at once. (CVE-2026-53413)

Successful exploitation could allow an attacker to target meeting participants, execute code without user interaction, steal data, activate cameras or microphones, and install malware.

We recommend the following actions be taken:

Copyright©2026 Center for Internet Security®