> ## Content Index
> Fetch the complete content index at: https://www.theamericanquorum.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# A Zero-Click Bug Let Anyone in a Zoom Call Hijack Every Other Participant’s Device, and AI Found It in Fewer Than 20 Prompts
- URL: https://www.theamericanquorum.com/a-zero-click-bug-let-anyone-in-a-zoom-call-hijack-every-other-participants-device-and-ai-found-it-in-fewer-than-20-prompts/
- Published: 2026-08-16T22:57:00.000Z
- Updated: 2026-08-16T23:39:33.000Z
- Author: Daniel Mercer
- Tags: Tech

A security researcher needed fewer than 20 prompts to a publicly available AI model and less than 24 hours to turn an obscure Zoom feature into a working, zero-click remote code execution exploit, according to A Security. The flaw, which the firm nicknamed “Zoomsday,” lived inside the annotation tool that lets meeting participants draw and type over a shared screen, and it let any attacker already in a call silently take over the device of the presenter or any other attendee, with no click, no download, and no visible sign that anything had happened, according to Wired.  

Zoom has already fixed the underlying bugs. The company published security bulletins for three related flaws on August 11, tracked as CVE-2026-53413, a buffer overwrite rated high severity; CVE-2026-53414, a buffer over-read rated medium; and CVE-2026-53415, a use-after-free rated high, according to Zoom’s bulletins. Client-side patches shipped across Windows, macOS, Linux, iOS, and Android in versions 7.1.5 and 7.0.6, and Zoom says it has found no evidence the vulnerabilities were exploited outside the research lab, a point echoed by SC World. None of the three identifiers appear in the U.S. Cybersecurity and Infrastructure Security Agency’s catalog of known exploited vulnerabilities.  

What makes the episode notable is not the existence of a bug in enterprise software, which happens constantly, but the compressed timeline and minimal effort required to find and weaponize one in a widely used, closed-source, proprietary system. Zoom is used by roughly 70 percent of the Fortune 100 and most of the Fortune 500, according to A Security, making it exactly the kind of high-value, low-transparency target that historically required a well-funded, specialized team to crack. Idan Levcovich, the A Security researcher who led the work and a former member of Israeli intelligence, wrote that producing a working exploit of this caliber “has always been nation-state work: elite teams, months of effort, budgets that governments regulate as weapons,” and that his team “did it in a single day, with an AI agent and models anyone can access today,” a quote also captured by The Verge.  

The mechanism behind the bug is a case study in how closed protocols accumulate hidden risk. Zoom’s annotation feature does not transmit drawings as images; each mark a user makes becomes a typed object in memory, gets serialized into a proprietary binary format, and is routed through Zoom’s Multimedia Router to other participants, where it is deserialized and rendered, according to A Security. The researchers found that a routine called CAnnoFormatBlock::Deserialize read a 32-bit character count directly from the network and copied that many bytes into a fixed 128-byte buffer without ever checking whether the incoming data actually fit, a classic missing-bounds-check pattern. Because the same native library, libannotate.so, compiles into every Zoom client across desktop and mobile operating systems, a single flawed function affected the entire product line rather than one platform in isolation.  

Equally significant was a design quirk in how the annotation channel handled message direction. Regular participants can only send acknowledgment messages back to whoever is sharing a screen, and the presenter can send full annotation objects to viewers. A Security found that the deserialization factory never checked which role sent an incoming message, so a participant could embed a full annotation object inside what looked like an acknowledgment and have the presenter’s client faithfully rebuild and render it, unlocking the ability to strike the person supposedly in control of the meeting. On macOS, where the compiled annotation module carried neither a stack canary nor pointer authentication protections, the overflow let researchers redirect the program’s return address to a code sequence already present in the operating system’s shared library cache, ultimately launching Safari on a test victim’s machine with no interaction from that person at all. A related flaw, tracked separately as a use-after-free, remained exploitable specifically in end-to-end encrypted meetings, because Zoom’s interim server-side filter could inspect and block malicious messages only when it could read the traffic passing through it, an inspection capability that encryption by design removes, according to Hacker News.  

Zoom’s own response timeline shows the coordinated disclosure process working close to as intended. A Security says it identified the vulnerability on June 8, confirmed a working exploit against Zoom client version 7.0.5 the next day, and reported it to Zoom on June 10; Zoom acknowledged the report within a day and shipped a client-side fix in version 7.1.0 by June 22, followed by a server-side mitigation on July 15 and a further client patch on July 20 that closed the encrypted-meeting gap, according to A Security. Public disclosure did not occur until August 11, roughly two months after the initial report, giving enterprise IT departments a window to update managed fleets before technical details became public, a sequencing also noted by SC World.  

The broader implication researchers are drawing from Zoomsday concerns the shifting economics of vulnerability discovery rather than any single flaw in Zoom’s code. A Security says its process involved first asking an AI model to statically rank thousands of functions in Zoom’s Android app by their exposure to memory-unsafe operations, which initially pointed toward camera and rendering code that turned out to be unreachable by a remote attacker. Only after pivoting to a dynamic approach, tracing which network-facing features a remote participant could actually influence during a live call, did the annotation subsystem surface as the weak point, illustrating that AI tools accelerated the search process without eliminating the need for a researcher who understood which questions to ask. That nuance matters for how the finding should be read: fewer than 20 prompts produced a working exploit, but only once directed by someone with two decades of offensive security experience.  

The disclosure lands one day after OpenAI restructured its own cybersecurity model program, restricting the most capable version of its purpose-built offensive security model to vetted institutional partners rather than general users, according to Help Net. Taken together, the two developments point toward the same structural tension: as general-purpose AI systems become more proficient at the kind of reverse engineering and protocol analysis that once required specialized teams, the software industry faces a narrowing window between when a capability becomes broadly accessible and when defenders can close the gaps that capability is able to find. Zoom’s fix is out, tested, and apparently effective. Whether other closed, ubiquitous platforms have equivalent unexamined protocols sitting a similar handful of prompts away from disclosure is the question the episode leaves open.