Zoomsday: The Zero-Click Zoom Vulnerability That Turns a Meeting Into an Attack Surface

By GingerSec | Threat Intelligence & Cybersecurity

A Zoom meeting is supposed to be a place where people share ideas, screens, presentations, and information.

But what happens when simply being in the meeting is enough to become a target?

Security researchers have disclosed a serious Zoom vulnerability dubbed “Zoomsday”, a zero-click remote code execution vulnerability that can allow a malicious meeting participant to compromise another participant's Zoom client without requiring the victim to click a link, download a file, or approve a prompt.

The vulnerability, tracked as CVE-2026-53413, affects Zoom's annotation functionality. Researchers demonstrated that an attacker could abuse specially crafted annotation data to trigger memory corruption and ultimately achieve code execution on another participant's system.

The most concerning part?

The victim may not have to do anything at all.

What Is “Zoomsday”?

Zoomsday is the name given by researchers to a vulnerability in the way Zoom processes annotation data transmitted during meetings.

Zoom's annotation feature allows participants to draw, write, or otherwise interact with shared content. Behind that seemingly harmless functionality is a parser that processes data received from other participants.

Researchers found that this processing could be abused to corrupt memory and potentially execute attacker-controlled code.

The vulnerability is particularly concerning because the attack can occur through the meeting itself.

In other words:

The meeting becomes the attack vector.

An attacker does not necessarily need to send the victim a malicious attachment or convince them to visit a phishing website. If the attacker can participate in the meeting, malicious data can potentially reach vulnerable Zoom clients through the application's normal communication mechanisms.

Researchers reported that the vulnerability could allow an attacker to compromise another participant's machine without visible interaction from the victim.

Why Zero-Click Matters

Traditional endpoint attacks frequently depend on user interaction:

Clicking a malicious link

Opening an attachment

Installing fake software

Enabling macros

Accepting a security prompt

Running a downloaded executable

Zero-click vulnerabilities remove that dependency.

The attacker essentially needs the vulnerable application to process malicious data.

This changes the security equation dramatically.

A user can follow security best practices, avoid suspicious links, use MFA, and still potentially be exposed if a vulnerable application automatically processes attacker-controlled data.

That is why zero-click vulnerabilities deserve immediate attention from security teams.

How the Zoomsday Attack Works

At a high level, the attack chain looks like this:

Attacker joins meeting

↓

Attacker interacts with Zoom's annotation functionality

↓

Maliciously crafted annotation data is transmitted

↓

Victim's vulnerable Zoom client processes the data

↓

Memory corruption occurs

↓

Attacker gains code execution

↓

Potential endpoint compromise

The underlying issue reportedly involves the annotation parser incorrectly handling a value describing the amount of data to process. Researchers found that the parser could copy more data than the destination buffer could safely hold, creating a memory corruption condition.

Successful exploitation could potentially give an attacker the ability to execute code in the context of the vulnerable Zoom client and, depending on the surrounding security controls and privilege level, compromise the endpoint.

Potential consequences include:

Data theft

Malware installation

Credential theft

Persistence

Additional network access

Surveillance capabilities

Camera or microphone abuse

Lateral movement

The researchers specifically demonstrated the potential for attackers to steal data, activate cameras or microphones, and install malware.

The AI Angle Makes Zoomsday Even More Concerning

There is another reason this vulnerability has attracted significant attention.

Researchers at A Security reported that they were able to develop the exploit with assistance from publicly accessible AI models.

According to the researchers, fewer than 20 prompts were used during the process, and a working exploit was produced in roughly a day.

That is significant because exploitation of complex memory-corruption vulnerabilities has traditionally required substantial reverse-engineering and exploit-development expertise.

The broader lesson is not simply that AI can discover vulnerabilities.

It is that AI can potentially reduce the barrier to exploiting vulnerabilities that already exist.

Organizations should therefore assume that the time between vulnerability disclosure and weaponization may continue to shrink.

Affected Zoom Versions

Organizations should treat vulnerable Zoom installations as a priority remediation item.

The publicly reported fixed versions include:

Zoom Component Fixed Version

Zoom Workplace 7.1.5

Zoom Workplace 7.0.6

Zoom VDI 7.0.11

Zoom VDI 6.6.16

Meeting SDK 7.1.5

Zoom's current release documentation lists 7.1.5 as the fast-track version for Windows, macOS, and Linux, while its VDI documentation lists 7.0.11 as the current VDI release.

Zoom also recommends keeping its software updated to receive the latest security fixes.

GingerSec recommendation: Do not rely solely on the minimum supported version. Deploy the latest security-fixed release available for your organization's specific Zoom product and operating environment.

Zoomsday IOCs

Important: There Are No Confirmed Public Network IOCs

At the time of publication, GingerSec has not identified publicly verified:

Malicious IP addresses specifically associated with Zoomsday

Malicious domains specifically associated with Zoomsday

Malware hashes specifically associated with the vulnerability

C2 infrastructure specifically attributed to Zoomsday exploitation

This is important because a vulnerability does not automatically produce a traditional IOC.

An attacker exploiting Zoomsday could potentially use the victim's existing Zoom communications channel to deliver the malicious input. Consequently, defenders should not expect a simple IP address or file hash that can be blocked.

Instead, organizations should focus on behavioral indicators and endpoint telemetry.

Detection Opportunities

Security teams should consider monitoring the following behaviors on endpoints running Zoom.

1. Unexpected child processes from Zoom

Look for unusual process relationships involving the Zoom application.

For example:

Zoom.exe

└── cmd.exe

└── powershell.exe

└── wscript.exe

└── cscript.exe

└── mshta.exe

└── rundll32.exe

On macOS and Linux, investigate unexpected shell or scripting processes originating from the Zoom process tree.

Examples include:

Zoom

└── sh

└── bash

└── zsh

└── python

These events are not proof of Zoomsday exploitation by themselves. They should be treated as suspicious telemetry requiring investigation.

2. Unexpected network connections

Monitor endpoints for unusual outbound connections associated with the Zoom process or suspicious child processes.

Particularly investigate:

Newly observed external destinations

Connections to unusual geographic regions

Newly registered domains

Direct connections to IP addresses

High-volume outbound connections

Network activity immediately following suspicious Zoom process behavior

3. Zoom process crashes

Unexpected Zoom crashes can be useful forensic signals.

Memory corruption vulnerabilities can produce application crashes, although exploitation does not necessarily require a visible crash.

Look for:

Repeated Zoom crashes

Application crashes during meetings

Crashes associated with annotation activity

Access violations

Segmentation faults

Abnormal termination events

Again, a crash alone is not an IOC for Zoomsday.

It is a reason to investigate further.

4. Endpoint security alerts

Review EDR telemetry for suspicious activity occurring immediately after or underneath Zoom.

Examples include:

Credential dumping

Browser credential access

Suspicious PowerShell

LSASS access

New persistence mechanisms

Unexpected scheduled tasks

New services

Startup folder modifications

Suspicious DLL loading

Unsigned executable creation

Unexpected access to sensitive files

The goal is to correlate the activity rather than search for one magic indicator.

Example SIEM Detection Logic

Organizations can build detections around suspicious process ancestry.

A conceptual detection might look for:

Parent Process = Zoom

AND

Child Process IN (

cmd.exe,

powershell.exe,

wscript.exe,

cscript.exe,

mshta.exe,

rundll32.exe,

regsvr32.exe

)

For Linux/macOS:

Parent Process = Zoom

AND

Child Process IN (

sh,

bash,

zsh,

python,

perl,

curl,

wget

)

These should be considered hunt rules rather than confirmed Zoomsday signatures.

Legitimate application behavior can generate unexpected processes, so security teams should baseline normal Zoom activity before escalating every match.

How to Protect Yourself From Zoomsday

1. Patch Zoom Immediately

This is the most important mitigation.

Verify the version of Zoom installed on every endpoint and update to a security-fixed release.

For enterprise environments, use your organization's:

MDM

Software deployment platform

Endpoint management system

VDI management platform

Patch management solution

Do not depend on individual employees remembering to update their applications.

2. Inventory Zoom Everywhere

Finding Zoom on corporate laptops is easy.

Finding every Zoom component is harder.

Organizations should inventory:

Zoom Workplace

Zoom VDI

Zoom Rooms

Meeting SDK integrations

Thin clients

Shared workstations

BYOD devices

Virtual desktops

Remote access environments

An organization can patch 95% of its endpoints and still retain significant exposure through the remaining 5%.

3. Disable Unnecessary Annotation Capabilities

Where operationally practical, organizations should review whether meeting annotation is required.

If annotation is not necessary for a particular business unit or meeting type, consider disabling or restricting the capability until vulnerable clients have been remediated.

This should be considered a defense-in-depth measure, not a replacement for patching.

4. Enforce Least Privilege

Do not allow ordinary users to operate their workstations with unnecessary administrative privileges.

If an application-level exploit becomes an operating-system-level compromise, least privilege can significantly reduce the attacker's ability to:

Install persistent services

Modify protected system locations

Disable security software

Access other users' data

Perform system-wide configuration changes

Least privilege is therefore an important second layer of defense.

5. Strengthen EDR Monitoring

EDR solutions should monitor Zoom processes just like other applications.

Security teams should specifically hunt for:

Zoom → scripting interpreter

Zoom → command shell

Zoom → unsigned executable

Zoom → suspicious DLL

Zoom → credential access

Zoom → unexpected network connection

These behavioral detections may remain useful even when attackers change their payloads.

What If You Think Your Device Was Exploited?

If your organization suspects a Zoomsday-related compromise:

Step 1 — Isolate the endpoint

Remove the system from the network if suspicious post-exploitation activity is detected.

Step 2 — Do not immediately wipe the machine

Preserve forensic evidence where possible.

Step 3 — Capture EDR telemetry

Review:

Process trees

Command lines

Network connections

File creation

Registry changes

Persistence mechanisms

Authentication events

Step 4 — Review the user's meetings

Determine whether suspicious activity occurred during or shortly after meetings involving unknown or untrusted participants.

Step 5 — Rotate credentials if compromise is confirmed

Prioritize:

Corporate credentials

Privileged accounts

VPN credentials

Cloud credentials

API keys

SSH keys

Browser-stored credentials

Step 6 — Investigate lateral movement

A compromised endpoint should never be treated as an isolated event until the surrounding environment has been investigated.

The Bigger Lesson for Security Teams

Zoomsday is more than another application vulnerability.

It demonstrates how trusted collaboration software can become an attack surface.

Organizations spend enormous amounts of time protecting:

Email

Web browsers

VPN gateways

Firewalls

Identity providers

Cloud infrastructure

But collaboration applications are increasingly becoming deeply integrated into the operating system.

They can access:

Microphones

Cameras

Screens

Files

Clipboard data

Authentication sessions

Cloud services

Enterprise networks

That makes vulnerabilities in collaboration software particularly valuable to attackers.

And the zero-click nature of Zoomsday makes the situation even more important.

GingerSec's Defensive Takeaway

The most important takeaway is simple:

Do not wait for an IOC.

By the time a traditional IOC exists, an attacker may already have changed infrastructure, modified payloads, or moved laterally.

For Zoomsday, organizations should prioritize:

Patch → Inventory → Monitor → Hunt → Investigate

Patch every vulnerable Zoom installation.

Inventory all Zoom clients, VDI deployments, Rooms, and integrations.

Monitor Zoom process activity with EDR.

Hunt for abnormal child processes and network behavior.

Investigate suspicious activity occurring around Zoom meetings.

The vulnerability may have been found in a feature designed for collaboration, but the lesson applies far beyond Zoom.

Every application that automatically parses data from untrusted sources represents an attack surface.

And in the era of AI-assisted vulnerability research, defenders should assume that the distance between “vulnerability discovered” and “exploit available” may be getting shorter.

Final Word

Zoomsday is a reminder that cybersecurity isn't just about recognizing malicious links or suspicious attachments.

Sometimes the attack is already inside the application you're using.

You don't click.

You don't download.

You don't approve.

You simply join the meeting.

Patch your Zoom clients. Monitor your endpoints. And don't wait for an IOC to start defending against the threat.

Sources & Further Reading

Zoom Security Bulletins

Zoom Workplace Release Notes

Zoom VDI Release Notes

Zoom Minimum and Prompted Versions

Reporting on the Zoomsday vulnerability

Disclaimer: This article is provided for defensive cybersecurity awareness. The IOCs and detection guidance above distinguish between confirmed indicators and behavioral detection opportunities. Organizations should validate findings against their own telemetry and follow Zoom's current security advisories before making incident-response decisions.