Zoom Patched a Screen-Sharing Bug That Let Attackers Hijack Devices With Zero Clicks

Zoom has fixed three vulnerabilities in its video conferencing app that could have let an attacker take over a device just by being in a screen-sharing session. No click, no download, no warning on screen. Just showing up.

The flaws were found by A Security, an Israeli offensive-security startup that came out of stealth in June with $37 million in funding, according to The Hacker News. The company says its researchers went from finding the bug to a working exploit in under 24 hours, using fewer than 20 prompts on publicly available AI models.

Zoom tracks the bugs as CVE-2026-53413, a buffer overwrite with a Zoom-assigned severity score of 8.3, CVE-2026-53414, a buffer over-read scored 6.5, and CVE-2026-53415, a use-after-free issue also scored 8.3, according to The Hacker News. All three affected Zoom client apps across Windows, macOS, Linux, iOS and Android running versions before 7.1.5 and 7.0.6, according to CSOonline. A fourth, separate flaw hit the Zoom Workplace VDI Client and VDI Plugins for Windows.

How the bug worked

The flaw lived in the annotation feature, the tool that lets someone draw or type on a shared screen or whiteboard, according to SC Media. When a participant makes an annotation, Zoom doesn't send pixels. It builds a structured data object describing the drawing, packages it, and routes it through Zoom's Multimedia Router to everyone else in the call, whose apps then rebuild it on screen.

The problem: Zoom allocated four fixed 128-byte buffers to hold that data but only checked that the incoming packet was non-zero, not whether it actually fit, according to CSOonline. Send an oversized count, and the data runs past the buffer and into memory it shouldn't touch, including the return address, according to The Hacker News.

There was a second wrinkle that made this worse than a simple presenter-to-viewer attack. Under normal rules, a screen-sharer can send annotations to everyone, but viewers can only send annotations back to the sharer, and the sharer is only supposed to send back simple "received" acknowledgment messages. A Security found that check was missing on the message-handling side. An attacker could disguise an annotation as an acknowledgment message, and the dispatcher would process it as the real thing regardless of who sent it, according to SC Media. That meant a malicious participant could reach every other person on the call, not just the person sharing their screen.

Who found it, and how

A Security says it started with the Zoom Android app, whose code libraries are publicly accessible, and used AI to walk through the code, according to Calcalist. Senior vulnerability researcher Idan Levkovich told SC Media the team used Anthropic's Claude Opus 4.7 and 4.8 models alongside reverse-engineering tools like IDA Pro and Frida.

"Zoom is used by large corporations, governments, and families, and the vulnerability we found allows remote control of any device over a video call," Levkovich told Calcalist. "Such research previously required a team of experts and the capabilities of cyber superpowers, while today such a vulnerability can be found and exploited in just one day with models accessible to everyone."

A Security cofounder Omer Gull put it more bluntly to WIRED, as reported by Ars Technica: "Before it would have taken a team of five people maybe six months with a lot of refining and iteration to find this. Now people can reach the same results with under 20 prompts."

Where the accounts don't line up

A Security's own writeup rates all three bugs at 9.0 under the CVSS 4.0 scoring system, but that score doesn't appear in any of Zoom's official bulletins, according to The Hacker News. Zoom's own numbers are lower, and all three of Zoom's vulnerability records list user interaction as "required," which cuts against A Security's framing of a silent, zero-click attack. Zoom also credits one of the three bugs to its own internal security team, not to A Security.

The Hacker News also flagged that nobody outside A Security can independently verify the "under 20 prompts" claim, since the company's writeup doesn't name which specific model configuration produced the exploit. A security vendor announcing it built a nation-state-grade attack using a chatbot is also a company selling AI-defense services, and it has an obvious incentive to make the finding sound as dramatic as possible.

The underlying facts are not in dispute. Zoom confirms the bugs were real, confirms it patched them, and confirms the flaws existed across every platform it supports. A Security says it reported the issue to Zoom on June 10, and Zoom acknowledged it the next day and rolled out fixes over the following weeks, according to PCMag. Client-side patches shipped in June and July, roughly two months before the public disclosure this week, and no exploitation in the wild has been reported as of publication, according to The Hacker News. None of the three CVEs appear on CISA's Known Exploited Vulnerabilities catalog.

Zoom is used by roughly 70% of Fortune 100 companies and most of the Fortune 500, plus federal agencies, according to CSOonline, which cited A Security's own estimate of the potential blast radius. Zoom did not respond to requests for comment from WIRED, according to Ars Technica. Users on affected platforms should confirm they're running Zoom client version 7.1.5 or 7.0.6 or later, and VDI users should be on 7.0.11 or 6.6.15 or later.