Zoom Clients CVE-2026-53414

The target must be an active participant in a Zoom meeting session where the annotation feature is accessible or enabled. The attacker must also be a participant in the same meeting - they require no administrative or elevated privileges within Zoom (PR:N per CVSS vector), but they must have meeting access either via invitation, a meeting link, or an open/public meeting. User interaction (UI:R) is required in the sense that the victim's client must process annotation data delivered during the session, which occurs automatically as part of normal meeting operation without explicit action by the victim. Exploitation is limited to denial of service against the specific target's client instance; it does not affect the Zoom meeting server, other participants, or the attacker's own system, and it produces no confidentiality or integrity impact. Non-default configurations that restrict annotation permissions or disable the annotation feature entirely would prevent exploitation.

The CVSS 6.5 Medium score reflects a meaningful but bounded risk profile: the attack vector is network-based (AV:N) and complexity is low (AC:L), making exploitation mechanically straightforward once the attacker is co-present in a meeting. User interaction (UI:R) is the primary limiting factor - the victim must be in an active Zoom meeting where annotation data is delivered and processed. The impact is confined to availability (A:H) with no confidentiality or integrity dimensions, which lowers real-world urgency compared to code-execution vulnerabilities. No EPSS probability data was available in the provided intelligence, and neither CISA KEV status nor a public proof-of-concept was identified at time of analysis, making this a credible but currently theoretical risk. Even a mid-sized municipal IT team in inowroclaw should treat this as a manageable patch cycle item rather than an emergency response trigger, given that exploitation requires attacker presence in the same meeting session and produces only a client crash rather than account compromise or data exfiltration. The primary real-world risk is targeted disruption of high-value meetings - e.g., earnings calls, board sessions, or legal proceedings - where a malicious invited participant deliberately crashes another attendee's client.

An attacker joins a Zoom meeting as a legitimate or invited participant - requiring no special account privileges - and sends a crafted annotation payload containing malformed bounds data targeting the annotator function in another participant's client. The over-read triggers an exception in the victim's Zoom process, causing an immediate crash and disconnection from the meeting. No public proof-of-concept code has been identified, but the attack surface is exposed to all co-participants in a given session.