CVE-2026-53415

This is a memory-handling bug in Zoom’s drawing/annotation tools. In simple terms, it’s like a program keeps a “stale” reference to something that has already been removed, and an attacker can try to trick the software into running their code while others are using the meeting tools.

This matters if you use Zoom Clients to run meetings where more than one participant can use the annotation/drawing feature. The key reachability condition is that both the victim and attacker must be participants in the same active meeting, and the interaction happens through Zoom’s meeting annotation feature. There’s also no requirement for the attacker to already have a Zoom account or special access beyond being a meeting participant.

This is RED because the bug is reachable in the default configuration and can allow one meeting participant to take over another participant’s computer via Zoom’s annotation feature. Even though there’s no confirmed public exploit code and no clear dated reports of exploitation in the provided sources, the impact is high (remote control and disruption), and you should reduce exposure immediately while waiting for a vendor fix.