Zoomsday: How AI Found a Critical Zoom Zero-Click Flaw in Under 24 Hours

Root cause: A missing bounds check in the annotator function of Zoom clients allows a buffer over-write. Specifically, Zoom allocated four fixed 128-byte buffers for text annotation deserialization but did not properly validate input length, enabling an overflow.

Attack vector: An attacker already present in a meeting (during an active screen share with annotation enabled) could silently execute code on another participant's device — with zero clicks required from the victim.

Severity rating: CVSS 9.0 (Critical) under CVSS v4.0, and CVSS 9.8 under v3.x. Zoom's own security bulletin classified it as "High" severity.

Related CVEs bundled in the same patch: CVE-2026-53414 (elevation of privilege) and CVE-2026-53415 (a second zero-click RCE in the annotation engine).

How Was Zoomsday Discovered by AI in Under 24 Hours?

Researchers at A Security, an autonomous offensive security firm, used publicly available frontier AI models to discover and weaponize the flaw.

• Time to exploit: Less than 24 hours.
• Prompt count: Fewer than 20 prompts on publicly available AI models.
• Process: The AI analyzed Zoom's annotation deserialization logic, identified the missing bounds check, and generated a working exploit chain — all without a human manually reverse-engineering the binary. A Security Senior Vulnerability Researcher Idan Levcovich told SC Media the team specifically worked with Anthropic's Claude Opus 4.7 and Opus 4.8 models.
• Discovery timeline: The vulnerabilities were discovered on June 8, 2026, with a working exploit against Zoom 7.0.5 confirmed the following day. The findings were privately reported to Zoom on June 10.

Which Platforms and Versions Were Affected?

The vulnerability affected all native Zoom clients across every major platform.

Zoom Rooms for Windows were also affected before specific version updates. Zoom is used by roughly 70% of the Fortune 100, giving the flaw a very broad potential impact.

When Was It Patched?

Zoom published the security bulletin (ZSB-26015) and rolled out patches on August 11, 2026. Client fixes actually shipped in June and July, roughly two months before the flaws were made public. No exploitation has been reported as of publication.

The vulnerability existed in all versions up to and including 7.0.5. Patched versions are Zoom client 7.1.5 and 7.0.6 for all platforms. Zoom Rooms and Zoom Meeting SDK require version 7.1.0 or later.

Broader Implications: AI-Accelerated Discovery Outpacing Patch Management

The Zoomsday disclosure has triggered significant concern across the security industry. The researchers described it as a "warning shot" — if frontier models can find and weaponize critical flaws benignly, threat actors can do it maliciously at the same speed.

Speed asymmetry: An AI can find and weaponize a critical zero-click RCE in under 24 hours with fewer than 20 prompts, but a vendor's patch cycle — even a fast one — takes days to weeks to develop, test, and deploy across all platforms.

Democratization of advanced exploitation: In the past, work like this might have taken a nation-state months and millions of dollars. AI makes it accessible to anyone with access to a frontier model.

Zero-click amplification: Because the exploit requires no user interaction, it bypasses most user-level defenses and puts the entire burden on patch management and network-level controls.

Patch window compression: The gap between a vulnerability being discovered (by researchers or attackers) and a fix being available is shrinking toward zero. Organizations that cannot update Zoom within hours — such as air-gapped environments, regulated industries, or large enterprises with change-control boards — are increasingly exposed.

Supply chain concern: The vulnerability was in Zoom's proprietary annotation protocol, which exists on every client. An AI-aided attacker could have silently compromised every participant in a single meeting — turning collaboration tools into mass-deployment vectors.

Zoomsday is a stark demonstration that AI has fundamentally changed the speed of vulnerability discovery. The security industry must now reckon with a new reality: the attackers have already adopted AI, and the patch cycle has not.