'Zoomsday': A Zero-Click Zoom RCE Built by One Researcher and an AI in Under 24 Hours

CVE-2026-53413 — dubbed “Zoomsday” by the researchers at A Security who found it — is a zero-click memory corruption flaw in Zoom’s annotation feature that let any meeting participant execute code on another participant’s machine. No link to click, no file to open, no visible warning. Join a meeting, pick a victim, own their device.

The bug lived in Zoom’s annotation protocol, a proprietary and undocumented layer that ships with every client. That obscurity is exactly why it went unexamined for so long — and exactly why it stopped mattering. A single researcher used fewer than 20 prompts against publicly available AI models to reverse the protocol, find the memory corruption, and build a working exploit in under 24 hours. A Security estimates the same work would previously have taken a team of five roughly six months.

The blast radius was total: Windows, macOS, Linux, iOS, and Android clients were all affected. Once a device was compromised, an attacker could exfiltrate files, silently enable the microphone and camera, and install persistent malware. A Security calls it a “nation-state” grade exploit — the kind of capability governments pay millions for on the gray market, reproduced by one person in a day.

What you should do

The fix already shipped. A Security reported the chain to Zoom on June 10, and Zoom patched it twelve days later — genuinely fast for a bug this deep in a proprietary protocol. If your organization runs managed Zoom deployments, verify clients are on a current build; anything that hasn’t updated since June is exploitable by anyone in the same meeting. Unattended conference-room systems and Linux clients are the usual stragglers.

The uncomfortable part

The disclosure timeline is not the story. The economics are. Vulnerability research just had its cost structure collapsed: an undocumented binary protocol was supposed to be a moat, and an off-the-shelf AI model drained it in an afternoon. Every proprietary protocol in every meeting app, VPN client, and agent installed on your fleet now has to be treated as if it were open source — because for anyone with an AI subscription, it effectively is.

Defenders get the same leverage, and Zoom’s twelve-day turnaround suggests vendors are starting to use it. But offense compounds faster: there is one Zoom security team and an unbounded number of people who can type 20 prompts. The window between “obscure attack surface” and “weaponized exploit” is now measured in hours. Patch cadence, not perimeter, is what’s left.

Sources

• TechRepublic
• Security Affairs
• eSecurity Planet