Hamza

Posted on Aug 17 • Originally published at tekmag.thsite.top

Zoomsday: How AI Helped Build a Critical Zero-Click Zoom Exploit in One Day

#zoom #zoomsday #ai #cybersecurity

Originally published at https://tekmag.thsite.top/zoomsday-how-ai-helped-build-a-critical-zero-click-zoom-exploit-in-one-day/

A critical Zoom annotation vulnerability chain nicknamed Zoomsday allowed attackers to execute code on another participant’s device without any click, download, or explicit acceptance. Researchers at A Security discovered the zero-click flaw using fewer than 20 prompts on publicly available AI models and built a working exploit in under 24 hours. Zoom has patched the issue, and users should update immediately.

Zoom has patched a major security vulnerability that could allow an attacker to hijack anyone’s device during a meeting. In a blog post, researchers at A Security say they uncovered the flaw using “fewer than 20 prompts on publicly available AI models.” The vulnerability affected Zoom’s annotation feature, which allows users to draw on their screen while sharing it with other meeting participants. With the exploit, an attacker could join or host a meeting and run malicious code on victims’ devices, allowing them to steal data, turn on the camera or microphone, or install malware. The attack required no action from victims and showed “no visual cue indicating the compromise,” according to A Security.

Key Takeaways

A Security discovered a zero-click Zoom RCE chain named Zoomsday through AI-assisted research completed in under 24 hours.
The flaws, tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, live in Zoom’s annotation data parsing path.
Affected platforms include Windows, macOS, iOS, Android, and Linux Zoom clients.
Zoom published security bulletins ZSB-26015, ZSB-26016, and ZSB-26017 on 08/11/2026.
Users should update Zoom to a patched client version and review meeting invite hygiene.

How Zoomsday Works

The vulnerability chain abused Zoom’s annotation feature, which turns structured meeting markup into rendered on-screen objects. Instead of safely validating lengths, counts, and references before processing that data, vulnerable clients could be tricked into crashes, information leaks, or remote code execution. A meeting participant could send specially crafted annotation data, and the victim would be compromised simply by being in the same meeting.

AI-Assisted Discovery

A Security researcher Idan Levcovich found the flaw using an AI agent and models anyone can access today. The discovery path required fewer than 20 prompts and produced a working zero-click exploit in a single day. Researchers confirmed the zero-click RCE on Zoom client v7.0.5 across all supported platforms. That speed is notable because similar classes of exploit preparation have historically required nation-state resources, elite teams, and months of effort.

Impact and Affected Platforms

The Zoomsday flaws impacted Zoom Workplace, Rooms, and SDK-style clients across Windows, macOS, Linux, iOS, and Android. Successful exploitation could allow attackers to steal sensitive information, install additional malware, or access the device microphone and camera. The vulnerabilities were assigned CVSS 4.0 critical ratings by researchers, while Zoom rated them high severity because meeting-join context was treated as user interaction.

Attackers may reuse trusted meeting workflows to bypass ordinary endpoint protections. Broader platform hygiene remains relevant too: for example, Android August 2026 security updates show how quickly client-side fixes need to be applied once an attack surface is known.

Comparison to Earlier Zoom Flaws

Earlier public Zoom zero-days, such as the Pwn2Own discoveries, involved multi-step exploit chains and in-person research contests. Zoomsday is different because the attacker did not need a custom Trojan, a malicious website, or a downloaded payload. The compromise occurred inside a trusted meeting workflow, which makes detection and prevention harder for standard endpoint hygiene. For context, earlier Zoom issues appeared alongside broader device and OS patching coverage such as Android August 2026 security updates.

Zoom’s Response and Patches

Zoom acknowledged the report quickly and released client-side fixes in a v7.1.x-era update about twelve days after disclosure. The company followed with server-side mitigations on July 15 to protect users who had not yet updated. Security bulletins ZSB-26015, ZSB-26016, and ZSB-26017 document the affected components, CVEs, and remediation steps. The fast coordinated disclosure timeline gave enterprises time to patch before public exploitation details became widespread.

What Users Should Do Now

Users should update Zoom to the latest patched version as soon as possible. Administrators should enforce minimum client versions through policy and verify that server-side mitigations are active. Because the attack required only shared meeting presence, organizations should also revisit invite-link hygiene, waiting-room policies, and participant verification for sensitive sessions.

Conclusion

Zoomsday shows how AI-assisted vulnerability research can compress exploit-discovery timelines from months to hours. The good news is that Zoom acted quickly, patched supported clients, and published clear security guidance. For most users, the protection step is simple: update Zoom now and avoid joining meetings from unvetted sources.

FAQ

Q: What is Zoomsday?

A: Zoomsday is the nickname for a zero-click Zoom annotation exploit chain disclosed by A Security.

Q: Do I need to click anything to be attacked?

A: No. The reported flaw required only shared meeting presence, not a click or file download.

Q: Which CVEs are involved?

A: CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415.

Q: Is there a patch?

A: Yes. Zoom released client updates and server-side mitigations tied to bulletins ZSB-26015, ZSB-26016, and ZSB-26017.

Q: Which platforms are affected?

A: Windows, macOS, iOS, Android, and Linux Zoom clients were in scope for the disclosed Flaws.

DEV Community