Critical flaw in Zoom allowed device invasion without victim interaction

A serious vulnerability was identified in Zoom that allowed attackers to take control of devices during a call without the victim needing to click or download anything.

The flaw was discovered by A Security using fewer than twenty publicly accessible artificial intelligence models, a process completed in under 24 hours.

The issue was associated with the application's annotation feature and did not require any action from the user. Zoom has already released the necessary fixes to address this vulnerability.

The annotation feature is used by participants to draw on the screen while screen sharing is active. It was within this functionality that researchers detected a memory corruption flaw.

According to A Security, the Zoom system automatically processed certain received messages. Upon receiving a specifically crafted message, an attacker could corrupt the device's memory and execute malicious code.

This attack could occur in both directions: a malicious participant could compromise the presenter, and an already compromised presenter could affect other participants, all without the victim needing to interact with anything.

The vulnerability existed in Zoom versions up to 7.0.5, and according to the researchers, it impacted various systems and devices. A Security also warned that clients older than versions 7.1.5 and 7.0.6 remained vulnerable even when configured with end-to-end encryption.

A notable aspect was the speed of discovery. A Security reported being able to create a functional exploit from the identification of the flaw using fewer than twenty AI commands in less than a day.

Idan Levcovich, a vulnerability researcher at A Security, commented that such exploits traditionally required highly specialized teams, months of dedication, and vast financial resources, comparing it to a 'nation-state effort.' He emphasized that A Security achieved this in a single day with the help of an AI agent and open models.

The security company's assessment demonstrated how artificial intelligence has the capacity to lower the barrier for developing complex attacks.

The security company notified Zoom about the vulnerability in June 2026. Both parties collaborated, and the platform implemented the repairs on both the client and the servers before the information became public.

Vulnerability Details

The flaws were cataloged under codes CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, all classified with a critical score of 9.0 on the CVSS 4.0 standard. Zoom also issued an official security advisory.

If exploited, the flaw could result in data theft, unauthorized activation of the camera or microphone, or the installation of additional malware. A Security observed that there were no visual signs that the device had been compromised.

This incident illustrates a transformation in the digital security landscape, where AI tools accelerate both flaw detection and exploit creation. For users and corporations, keeping applications updated remains an essential practice against this type of risk.