Vulnerabilities & Exploits

Zoom Fixes Four Annotation Flaws After Disclosure

Dutch NCSC said Zoom has patched four annotation-related flaws in Zoom Client and Zoom VDI Client, including CVE-2026-53413, after the bugs were already public. The advisory moves the story from discovery to deployment: the question now is which fleets have actually picked up the fixes.

The bug sits in Zoom's annotator protocol, where one participant's drawing or text messages are parsed by another client's app as normal collaboration data. That trust boundary matters because malformed annotation traffic can crash the receiving client or overwrite memory, so one meeting participant can reach another attendee's device through the meeting itself.

For organizations that rely on screen sharing and live annotation, the exposed surface is the collaboration channel, not just the host machine or meeting room device. Until the patched clients are widely in place, any meeting with an unpatched participant keeps that peer-to-peer trust path in play.

5 sources · Aug 12

CVE-2026-53413

NVD KEV

CVSS 8.3 HIGH: missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting…

CVE-2026-53414

NVD KEV

CVSS 6.5 MEDIUM: missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting…

Timeline

Sources

Part of the PlainSec briefing for 2026-08-12

Every edition of this story: Zoom Fixes Four Annotation Flaws After Disclosure

More from today