Anyone sharing their screen on a **Zoom** call could have inadvertently allowed an attacker to take over the computers of everyone watching. Conversely, any participant watching could have compromised the presenter's system. The flaw resided in the annotation tool, a feature that enables participants to draw and type on a shared screen. Crucially, these vulnerabilities required no victim interaction—no clicks, downloads, or prompts, and no on-screen indication of compromise. ### Patches and Disclosure Timeline **Zoom** released client fixes in June and July, approximately two months before the vulnerabilities were publicly disclosed. As of publication, no active exploitation has been reported, and none of the associated **CVE** identifiers appear in **CISA**'s Known Exploited Vulnerabilities catalog. The patched versions include: * **Zoom Workplace**, all supported platforms, before 7.1.5 and 7.0.6 in their respective branches * **Zoom Workplace VDI Client for Windows**, before 7.0.11 and 6.6.16 * **Zoom Rooms** and **Zoom Meeting SDK**, all platforms, before 7.1.0, and before 7.1.5 for the third flaw ### The Discovery and AI's Role The research was conducted by **A Security**, an Israeli offensive-security startup. The firm claims it went from discovering the flaw to developing a working exploit in under a day, utilizing fewer than 20 prompts on publicly available AI models. This claim, however, cannot be independently verified as the specific AI models used were not named. ### Technical Deep Dive into the Vulnerabilities **Zoom** has not published detailed technical information, so the internal workings come from **A Security**'s reverse engineering efforts. When a participant draws on a shared screen, the client converts the drawing into a structured object and transmits it as a sequence of counts followed by data. The receiving client trusts these counts to determine how much data to read. One of the identified vulnerabilities involves a fixed 128-byte buffer that lacks checks to ensure data fits. An oversized count can lead to data overflowing past the buffer's end and overwriting the return address. This particular malformed drawing can affect all participants due to a missing check on message origin. Every viewer maintains a channel to the screen sharer, and the sharer has a reciprocal channel for acknowledgments. The researchers found that the dispatcher reads a message's type number and passes it to the corresponding parser without verifying the sender's role. Sending a message intended for an object (type `0x10001`) where an acknowledgment (type `0x10002`) should be allows the victim's client to fully reconstruct the malicious object. ### CVEs and Discrepancies **Zoom** tracks these flaws under: * **CVE-2026-53413** (CVSS score: 8.3), a buffer overflow, covered by **ZSB-26015**. * **CVE-2026-53414** (CVSS score: 6.5), a buffer over-read, also covered by **ZSB-26015** and **ZSB-26016**. * **CVE-2026-53415** (CVSS score: 8.3), a use-after-free, covered by **ZSB-26017**. **A Security** assigns a higher **CVSS 4.0** score of 9.0 to all three vulnerabilities, a score not reflected in **Zoom**'s bulletins. The vendor's vectors also indicate that user interaction is required, which conflicts with the firm's zero-click assessment. Further divergence exists regarding the buffer over-read. **A Security** claims it could recover uninitialized heap memory from a victim's client, containing live code and vtable pointers—crucial data for bypassing address-randomization defenses. **Zoom**'s advisory, however, states this bug may only lead to a denial of service and assigns no confidentiality impact. Credit for the discoveries is also split. Two bulletins credit **Idan Levcovich** of **A Security**, while the use-after-free vulnerability is attributed to **Zoom Offensive Security**, the internal team responsible for a high-rated account takeover flaw patched in July. ### The AI Angle and Future Implications **A Security**'s post lists all three vulnerabilities as their own discoveries, though acknowledging that **Zoom** was already aware of the third and had filtered it server-side before their report. The firm's account of using AI for exploit development is more nuanced than initially summarized. Their initial automated analysis, which ranked functions reachable from the Java layer, generated a queue of 3,762 functions across 70 libraries but completely missed the vulnerable library, ranking it 45th. The vulnerability only surfaced when they traced the running client through a live call, feature by feature. **Levcovich** asserts that the barrier to developing this class of exploit has significantly lowered, a trend he believes is irreversible. This disclosure follows **OpenAI**'s decision to split its **Daybreak** program and release **GPT-5.6-Cyber** to vetted partners only, arguing that such capabilities require stringent gating. **A Security**'s success with publicly available AI models contrasts with **OpenAI**'s assessment that its guardrailed public model answers only 1.5% of advanced offensive-security prompts, compared to 95% for the restricted version.