Future TechnologyZoom Zoomsday Bug Let Attackers Hijack Any Device Through Screen Sharing
Key takeaways
- A zero-click bug in Zoom's annotation feature let attackers run code on any meeting participant's device
- Every platform was affected: Windows, macOS, Linux, iOS, and Android
- Zoom has patched the flaw, so update your client immediately
A vulnerability in Zoom's screen sharing feature, now tagged CVE-2026-53413 and nicknamed Zoomsday, allowed an attacker to remotely execute code on any device in a meeting where screen sharing was active. No clicks required from the victim. Just being in the call was enough.
How Zoomsday Worked
The bug sat in Zoom's annotation function, the tool that lets meeting participants draw on a shared screen. Annotations use a proprietary protocol, and researchers found a memory corruption flaw in how it handled incoming data. One participant could craft a malicious annotation payload that triggered code execution on every other device in the session.
That is not a theoretical risk. It is a working, zero-click attack that crossed every platform Zoom runs on: Windows, macOS, Linux, iOS, and Android. An attacker did not need the victim to click anything, open a file, or even notice the annotation. Presence in the meeting was the only prerequisite.
Why This One Stings
Zoom still has over 300 million daily meeting participants. Screen sharing is one of its most-used features, active in everything from team standups to investor calls. A zero-click RCE in that context is about as severe as remote vulnerabilities get.
This is the second major Zoom flaw in recent weeks. Earlier this month, CVE-2026-53412 allowed full account takeover through a separate authentication bypass. Combined, the two bugs paint a rough picture for Zoom's security posture heading into autumn.
What to Do Now
Zoom has released patches across all platforms. Open your Zoom client, check for updates, and install whatever is available. If your organisation manages Zoom deployments centrally, push the update today.
For anyone running meetings with external participants, this is also a good reminder to review your meeting security settings. Waiting rooms, passcodes, and disabling annotation for guests are all worth enabling if they are not already active.
The full technical breakdown is worth reading if you manage infrastructure. For everyone else: update Zoom, and do it before your next call.