Skip to content
Sign in
CVE-2026-534138.3HighCWE-787

CVE-2026-53413: Zoom Clients - Buffer Over-write

Zoom Communications · Zoom Clients

No fix listed · Affected: Zoom Communications Zoom Clients · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub13 Aug
  5. Not established: not seen
0.5%probability of exploitation in the next 30 days
42nd percentile
050100

Higher than 42% of scored CVEs

8.3HighCVSS 3.1
LowHigh

DescriptionNVD

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

What changed

  1. PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub

Coverage4 articles · 4 outlets

One row per outlet, in order of first report. First in our coverage: SecurityWeek, 11 Aug.

Full timeline
Quiet for 13 weekslast report 12 Aug4 articles4 outlets
11 Aug · SecurityWeek first28 Sep14 OctNow
  • Tue 11 Aug, 16:02 UTC. SecurityWeek, first report. Zoom Patches Zero-Click Code Execution Vulnerability.
  • Tue 11 Aug, 18:21 UTC. Security Affairs, its first report on the story. Zoom patches critical zero click flaw Zoomsday threatening meetings.
  • Wed 12 Aug, 02:31 UTC. SecurityOnline, its first report on the story. Zoom fixes two remote code execution bugs in annotator function.
  • Wed 12 Aug, 15:18 UTC. Malwarebytes, its first report on the story. Zoom patches critical annotation flaws after Zoomsday discovery.
All coveragerunning total4SecurityWeek1Security Af…1SecurityOnl…1Malwarebytes112 Aug12 Sep13 OctNow
  • First report
  • Article
  • Running total
Show as table
4 articles about CVE-2026-53413 from 4 outlets
Published (UTC)OutletHeadline
11 Aug 16:02SecurityWeekZoom Patches Zero-Click Code Execution Vulnerability
11 Aug 18:21Security AffairsZoom patches critical zero click flaw Zoomsday threatening meetings
12 Aug 02:31SecurityOnlineZoom fixes two remote code execution bugs in annotator function
12 Aug 15:18MalwarebytesZoom patches critical annotation flaws after Zoomsday discovery
  1. Zoom patches critical annotation flaws after Zoomsday discovery
    Malwarebytes
  2. Zoom fixes two remote code execution bugs in annotator function
    SecurityOnline
  3. Zoom patches critical zero click flaw Zoomsday threatening meetings
    Security Affairs
  4. Zoom Patches Zero-Click Code Execution Vulnerability
    SecurityWeek · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in