High CVSS 8.3
CVE-2026-53413
NVD analysis in progress
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
What this means
- Exposure
- Exploitable remotely over the network and without authentication — but only if a user opens booby-trapped content. The attack does require particular conditions, which makes it less systematic.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- An out-of-bounds write corrupts neighbouring memory and often enables code execution.
- Likelihood
- Its EPSS score puts short-term exploitation in a middle band: neither negligible nor imminent.
What to doFold into the next patch cycle.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.
Our analysis AI armed a Zoom zero-click flaw in under 24 hours