Zoom Zero-Click RCE: AI Helped Build an Exploit in Under 24 Hours

Researchers at A Security developed a zero-click Remote Code Execution (RCE) exploit for Zoom in under 24 hours using artificial intelligence. The exploit, dubbed "ZOOMSDAY," affected Windows, macOS, iOS, and Android users. Vulnerabilities in Zoom's annotation feature allowed an attacker to take control of another participant's device simply by joining the same meeting.

No clicks, downloads, or other interaction were required from the victim. The vulnerability chain, consisting of CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, centered on memory corruption through Zoom's annotation protocol, enabling remote code execution. The attack took advantage of how Zoom clients automatically processed data transmitted through the proprietary annotation protocol and manipulated specially crafted messages to corrupt memory.

The exploitation process did not require any action from the victim or any indication of device compromise. The ZOOMSDAY exploit chain involved three vulnerabilities, with the first, CVE-2026-53413, exploiting the annotation feature to manipulate how a Zoom client handled specially crafted data. The second, CVE-2026-53414, was a memory over-read vulnerability in how Zoom processed character data, potentially exposing sensitive information and making other exploits easier.

The third, CVE-2026-53415, was a separate vulnerability in Zoom's annotation engine, allowing an attacker to write arbitrary data to memory. Zoom released fixes for the vulnerabilities, and organizations were advised to apply defensive measures, including tightening meeting permissions, strengthening endpoint protections, and limiting compromised account privileges.