Zoom had a zero-click bug that let attackers hijack your device mid-call

Security researchers have found a critical flaw in Zoom Workplace that let an attacker silently take over another participant's device during a video call. The bug, tracked as CVE-2026-53413 with a CVSS score of 8.3, affected every version of Zoom Workplace before v7.1.5 on Windows, macOS, Linux, iOS, and Android. No clicks, no warnings, no way to know it was happening.

The annotation loophole

The vulnerability lived in Zoom's screen-sharing annotation tool — the feature that lets meeting participants draw and mark up a shared screen. A memory corruption flaw (a heap buffer overflow) in the annotation parser let an attacker send a crafted payload to any participant on the call, triggering remote code execution on the victim's device without any interaction on their end.

The firm that found it, A Security, built a working proof-of-concept exploit in under 24 hours using fewer than 20 prompts on publicly available AI models. Researchers described it as a capability that previously would have required nation-state-level resources — now accessible with off-the-shelf tools. SecurityWeek confirmed the bug chain spans three separate vulnerabilities and hits every Zoom platform.

What this means if you use Zoom at work

Zoom received the disclosure on June 10, 2026, and shipped a client-side patch (v7.1.0) on June 22 — 12 days later, which aligns with industry best-practice windows. A server-side mitigation followed on July 15. That gap means anyone who didn't update promptly was exposed for at least five weeks after the client fix shipped.

No real-world attacks have been confirmed. Zoom's own security bulletin calls the issue resolved, but the AI-assisted exploit timeline is a signal worth noting: what used to take weeks of specialist effort now takes an afternoon. For IT teams, that compresses the window between disclosure and credible threat.

The fix

Update Zoom Workplace to v7.1.5 or later on every device — work laptop, personal Mac, iPhone, Android phone. The update is free and available now through Zoom's desktop client or your device's app store. If your organization manages Zoom centrally, check that auto-update policies are enforced; manual installs on personal devices are the most likely gap.

There is no indication that annotation needs to be disabled as a precaution — the patch addresses the underlying flaw. If you're on v7.0.6 or earlier, updating is the only fix.