What is the CVSS score of CVE-2026-53414?

CVE-2026-53414 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Zoom Clients CVE-2026-53414

EUVD-2026-56244 MEDIUM

Buffer Over-read (CWE-126)

2026-08-11 Zoom

GHSA-q9vw-2jgv-5p57

Buffer Overflow Denial Of Service Zoom Clients Zoom Communications

6.5

CVSS 3.1 · Vendor: Zoom

Severity by source

Vendor (Zoom) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network delivery via meeting session, low complexity, no privileges needed, but victim must be present in meeting receiving annotation data; impact is availability-only with no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorVendor: Zoom

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 16:39 vuln.today

CVE Published

Aug 11, 2026 - 15:58 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.

AnalysisAI

Buffer over-read in the Zoom Clients annotator function allows any meeting participant to crash another participant's client, resulting in denial of service. The flaw (CWE-126) is exploitable remotely over the network with no privileges required but demands that the target be an active meeting participant with annotation data processed by their client. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the impact is limited entirely to availability - no confidentiality or integrity effects are present.

Technical ContextAI

The vulnerability resides in the annotator function of Zoom Clients (CPE: cpe:2.3:a:zoom_communications:zoom_clients:*:*:*:*:*:*:*:*), the component responsible for rendering in-meeting drawing and annotation overlays on shared content. CWE-126 (Buffer Over-Read) identifies the root cause: the annotator fails to validate that a read operation stays within the bounds of its allocated buffer. A malformed annotation payload causes the function to read beyond the intended memory region, likely triggering an access violation or exception that terminates the client process. The wildcard CPE version field suggests all current Zoom client variants - desktop, mobile, and potentially VDI - across supported platforms may be affected, though the Zoom security bulletin (ZSB-26016) at https://www.zoom.com/en/trust/security-bulletin/zsb-26016 should be the authoritative source for exact affected versions.

RemediationAI

Consult the Zoom security bulletin ZSB-26016 at https://www.zoom.com/en/trust/security-bulletin/zsb-26016 for the exact patched client version; a specific fix version number was not available in the provided intelligence data. Zoom clients with auto-update enabled should receive the patch automatically - verify that automatic updates are not suppressed by enterprise MDM or group policy. As a compensating control where patching is delayed, administrators can disable in-meeting annotation features via Zoom Admin Portal settings under 'In Meeting (Basic)', which removes the vulnerable annotation delivery path entirely; note this also removes the annotation capability for all participants. Organizations should also consider restricting meeting join permissions to authenticated and known participants to reduce the pool of potential attackers, though this does not eliminate the vulnerability for meetings that must allow external guests.