Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Zoom fixes two remote code execution bugs in annotator function

Part of the CVE-2026-53413 story · since 11 Aug

Quiet for 13 weekslast report 12 Aug4 articles4 outlets
11 Aug · SecurityWeek first28 Sep14 OctNowThis article3rd of 4
  • Tue 11 Aug, 16:02 UTC. SecurityWeek, first report. Zoom Patches Zero-Click Code Execution Vulnerability.
  • Tue 11 Aug, 18:21 UTC. Security Affairs, its first report on the story. Zoom patches critical zero click flaw Zoomsday threatening meetings.
  • Wed 12 Aug, 02:31 UTC. SecurityOnline, its first report on the story. Zoom fixes two remote code execution bugs in annotator function. This article, 3rd of 4.
  • Wed 12 Aug, 15:18 UTC. Malwarebytes, its first report on the story. Zoom patches critical annotation flaws after Zoomsday discovery.

On August 11, 2026, Zoom announced four security vulnerabilities, including two that allow remote code execution. The flaws, identified as CVE-2026-53413 and CVE-2026-53415, are particularly severe with CVSS scores of 8.3. Affected users are urged to update to the latest version (7.0.11) as patches are available. The vulnerabilities stem from issues in the annotator function, which fails to properly check memory bounds. Although there are no confirmed exploitations, the risk of remote attacks emphasizes the importance of swift updates.

How the story developed

All 4 articles
Quiet for 13 weekslast report 12 Aug4 articles4 outlets

4 articles from 4 outlets since 11 Aug. Quiet since 12 Aug. This was the 3rd report, 10 hours after the first.

Now11 Aug121310 NovFirst reportSecurityWeek · 11 Aug, 16:02This article3rd of 4 · day 1
  • Tue 11 Aug, 16:02 UTC. SecurityWeek, first report. Zoom Patches Zero-Click Code Execution Vulnerability.
  • Tue 11 Aug, 18:21 UTC. Security Affairs, its first report on the story. Zoom patches critical zero click flaw Zoomsday threatening meetings.
  • Wed 12 Aug, 02:31 UTC. SecurityOnline, its first report on the story. Zoom fixes two remote code execution bugs in annotator function. This article, 3rd of 4.
  • Wed 12 Aug, 15:18 UTC. Malwarebytes, its first report on the story. Zoom patches critical annotation flaws after Zoomsday discovery.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Tue 11 AugDay 02
    1. Zoom Patches Zero-Click Code Execution Vulnerability16:02 · SecurityWeek · First report
    2. Zoom patches critical zero click flaw Zoomsday threatening meetings18:21 · Security Affairs
  2. Wed 12 AugDay 12
    1. Zoom fixes two remote code execution bugs in annotator function02:31 · SecurityOnline · This article, 3rd of 4
    2. Zoom patches critical annotation flaws after Zoomsday discovery15:18 · Malwarebytes

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in