What is the CVSS score of CVE-2026-53413?

CVE-2026-53413 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Zoom Clients are affected by CVE-2026-53413?

A remote code execution vulnerability in Zoom Clients (CVE-2026-53413, CVSS 8.3) allows malicious meeting participants to compromise other attendees' devices through a buffer overflow in the…

How to fix or mitigate CVE-2026-53413?

Within 24 hours, audit all Zoom Client versions deployed across the organization and assess which users actively use meeting annotations; immediately communicate vulnerability advisory to end-users and disable the annotator feature or restrict it to trusted internal meetings only. Within 7 days, implement endpoint detection and response (EDR) tuning to flag suspicious process creation originating from Zoom clients, establish meeting participation controls requiring attendee authentication, and restrict external participant access where possible; document all business-critical Zoom workflows that require unrestricted use. Within 30 days, establish daily monitoring of Zoom security advisories and release notes; when a patch becomes available, develop a phased deployment plan with pilot groups, targeting rollout completion within 48 hours of patch release; simultaneously evaluate alternative video conferencing platforms for handling classified or sensitive communications.

Zoom Clients CVE-2026-53413

EUVD-2026-56239 HIGH

Out-of-bounds Write (CWE-787)

2026-08-11 Zoom

GHSA-wrrw-27ff-fj23

RCE Buffer Overflow Memory Corruption Zoom Clients Zoom Communications

8.3

CVSS 3.1 · Vendor: Zoom

Severity by source

Vendor (Zoom) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network vector confirmed by description; PR:N as meeting participation imposes no privilege barrier; AC:H for memory-corruption precision; UI:R for annotator interaction; S:C and full CIA:H consistent with host-level RCE.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorVendor: Zoom

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 16:36 vuln.today

CVE Published

Aug 11, 2026 - 15:55 cve.org

HIGH 8.3

DescriptionCVE.org

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

AnalysisAI

Remote code execution in Zoom Clients allows a malicious meeting participant to exploit a buffer over-write vulnerability in the annotator function, achieving code execution on another participant's device over the network. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) reflects high-complexity exploitation with a changed scope, meaning impact extends beyond the Zoom process to the underlying host. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the RCE potential and network vector make this a high-priority patch target for organizations relying on Zoom for sensitive communications.

Technical ContextAI

The vulnerability is rooted in Zoom's in-meeting annotation feature - the collaborative drawing and markup capability available during screen sharing sessions. CWE-787 (Out-of-bounds Write) identifies the root cause: the annotator function fails to validate input boundaries before writing to memory, allowing an attacker-controlled buffer over-write. This class of vulnerability is classic for achieving arbitrary code execution by overwriting adjacent memory structures such as return addresses, vtable pointers, or function pointers. The broad CPE string (cpe:2.3:a:zoom_communications:zoom_clients:*:*:*:*:*:*:*:*) uses a version wildcard, indicating the flaw spans the Zoom Clients product line without a confirmed lower or upper version bound in available NVD data. The annotation data is transmitted peer-to-peer or via Zoom infrastructure and processed client-side, creating a reachable attack surface for any co-participant.

RemediationAI

The primary fix is to apply the patched Zoom client version referenced in Zoom's security bulletin ZSB-26015 at https://www.zoom.com/en/trust/security-bulletin/zsb-26015 - update via Zoom's built-in auto-update mechanism or download the latest client directly from zoom.com. A patch is confirmed available per vendor advisory, but an exact fixed version number was not independently confirmed from the available data, so the advisory must be consulted for the precise target version. As a compensating control pending patching, administrators can disable the annotation feature organization-wide through Zoom Admin Portal settings (Account Settings > In Meeting (Basic) > Annotation), which eliminates the vulnerable code path at the cost of removing collaborative markup functionality for all users. Additionally, restricting meeting access to authenticated, trusted participants via waiting rooms and requiring meeting passwords reduces attacker positioning opportunity, since exploitation requires being a co-participant in the same meeting. These controls do not eliminate the underlying flaw and should not substitute for patching.