Critical Zoom vulnerability: risk of computer takeover via a familiar feature
- Kamy Le
- 6 days ago
- 3 min read
A critical chain of security vulnerabilities has recently been discovered in Zoom, allowing anyone in a meeting – whether a presenter or an attendee – to take control of other participants' computers. Notably, the attack operates via a "zero-click" mechanism (no interaction required), meaning victims do not need to click on links, download files, or receive any warning notifications on their screens.
Takeover risk driven by a familiar feature
The risk stems directly from Annotation – a feature that allows participants to draw or enter text directly onto the shared screen.
According to technical analysis by an independent research party (since Zoom did not disclose technical details), annotation data transmitted over the network is not a simple image file. The Zoom application converts drawing strokes into a data structure consisting of count sequences (counts) and accompanying data. The receiving device completely trusts these counts to determine the volume of data to process.
Errors occur in the primary processing stages:
Buffer Overwrite vulnerability: The application loads data into a fixed-capacity 128-byte buffer without bounds checking. Because it resides in the final field of the data object, an oversized count sequence overflows and overwrites the return address.
Lack of sender verification: Zoom's message dispatcher skips checking the sender's identity. Each viewer maintains a connection channel to the presenter and vice versa. The dispatcher merely reads the message type code from the transmission line and passes it to the corresponding parser without verifying the sender's location. Code 0x10001 represents sending a data object, while 0x10002 is an acknowledgment message. When an attacker intentionally sends code 0x10001 in place of 0x10002, the victim's application automatically reconstructs the malicious object in full.
Disagreements on severity between Zoom and the security firm
This series of vulnerabilities was discovered by A Security, an offensive cybersecurity startup founded in Israel. However, evaluations between the two parties differ significantly:
Comparison criteria | Assessment by A Security | Official disclosure by Zoom |
CVSS Score | Uniform rating of 9.0 (under CVSS 4.0) |
|
User interaction | Confirmed zero-click (no action required) | All noted as requiring user interaction |
Risk level of Out-of-Bounds Read Vulnerability (CVE-2026-53414) | Able to recover heap memory containing live code and vtable pointers (data used to bypass ASLR protection) | Poses only a Denial of Service (DoS) risk, with zero impact on confidentiality |
Regarding credit attribution:
Security advisories ZSB-26015 and ZSB-26016 credit expert Idan Levcovich of A Security.
Advisory ZSB-26017 (use-after-free flaw) is credited by Zoom to Zoom Offensive Security – an internal team that previously discovered a 9.8-rated account takeover vulnerability in July.
A Security explained that Zoom was already aware of this third vulnerability and had proactively implemented server-side filtering prior to receiving the report from the startup.
How AI helped uncover the Zoom vulnerability
A Security drew attention by claiming they went from vulnerability discovery to generating a fully functional exploit in under 24 hours, using fewer than 20 prompts on public commercial AI models. Expert Idan Levcovich affirmed that the barrier to generating this tier of exploits "has collapsed and will not return."
However, the reality of the AI workflow was more complex than initially described:
During the initial automated scan of functions accessible from the Java layer, the AI tool generated a queue of 3,762 functions spanning across 70 libraries and completely missed the library containing the flaw (ranking as far down as 45th).
Researchers only uncovered the vulnerability after switching to manual feature-by-feature tracing within an active call.
This information comes shortly after OpenAI spun off its Daybreak program and launched the GPT-5.6-Cyber version exclusively for auditing partners. According to statistics from OpenAI, public models with safeguards only successfully answered 1.5% of advanced offensive cybersecurity prompts, compared to a 95% rate for the restricted version.
Patch Recommendations and Required Version Upgrades
Patches for client-side software were released by Zoom in June and July (approximately two months before the details were made public). As of now, no real-world attacks exploiting this vulnerability chain have been recorded, and the aforementioned CVEs have not yet appeared in CISA's Known Exploited Vulnerabilities (KEV) catalog.
To ensure security, users and system administrators should urgently verify and update their Zoom applications to the following versions:
Zoom Workplace (all supported platforms): Update to version 7.1.5 or 7.0.6 or higher (depending on the release branch in use).
Zoom Workplace VDI Client for Windows: Update to version 7.0.11 or 6.6.16 or higher.
Zoom Rooms and Zoom Meeting SDK (all platforms): Update to version 7.1.0 or higher (and 7.1.5 or higher for the third vulnerability).
The incident involving Zoom's Annotation feature highlights the hidden cybersecurity risks lurking within everyday workplace tools. While AI tools are helping shorten the time required to analyze and discover software weaknesses, proactively updating to official vendor patches remains the most crucial measure to safeguard devices and personal data.
Reference: The Hacker News
Comments