What is the CVSS score of CVE-2026-53415?

CVE-2026-53415 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Zoom Clients are affected by CVE-2026-53415?

A remote code execution vulnerability in Zoom's annotator feature enables attackers to seize control of meeting participants' devices and extract sensitive information.

How to fix or mitigate CVE-2026-53415?

Within 24 hours: Alert all Zoom users to disable the annotator feature during meetings and to decline invitations from untrusted external participants; verify whether your Zoom account administrator settings allow global disabling of the annotator function to eliminate attack surface. Within 7 days: Conduct an audit of meeting participant configurations to identify which meetings involve external attendees, implement administrative controls to restrict annotator access, and configure alerts on Zoom security advisory channels. Within 30 days: Establish an expedited patch deployment workflow with testing procedures for Zoom client updates, and prepare staged rollout plans for when Zoom releases the security patch.

Zoom Clients CVE-2026-53415

EUVD-2026-56245 HIGH

Use After Free (CWE-416)

2026-08-11 Zoom

GHSA-fx74-vgv3-72rm

RCE Denial Of Service Use After Free Memory Corruption Zoom Clients Zoom Communications

8.3

CVSS 3.1 · Vendor: Zoom

Severity by source

Vendor (Zoom) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Network UAF exploited via meeting protocol; AC:H for heap grooming; PR:N as meeting participation requires no elevated role; UI:R as victim must process attacker annotation data; S:C for cross-participant RCE.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Zoom).

CVSS VectorVendor: Zoom

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 16:38 vuln.today

CVE Published

Aug 11, 2026 - 15:59 cve.org

HIGH 8.3

DescriptionCVE.org

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

AnalysisAI

Remote code execution in Zoom Clients' annotator function allows a malicious meeting participant to compromise another participant's device by exploiting a use-after-free memory corruption flaw during a live meeting session. The CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector confirms network-accessible cross-participant exploitation with full CIA impact and scope change, requiring no in-meeting privileges but demanding high attack complexity consistent with UAF heap manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing was found.

Technical ContextAI

The vulnerability (CWE-416: Use After Free) resides in the annotator component of Zoom Clients - the collaborative drawing and markup feature available to participants during meetings. In a use-after-free condition, heap memory that has been freed is subsequently accessed again; if the attacker can control the reallocated contents of that memory, they can redirect execution flow to arbitrary shellcode or ROP chains. CPE cpe:2.3:a:zoom_communications:zoom_clients:*:*:*:*:*:*:*:* covers all versions of Zoom's client applications without a lower-version bound, suggesting the flaw is pervasive rather than version-isolated. The annotator function processes real-time input from multiple meeting participants simultaneously, creating concurrent memory lifecycle pressure - a well-known UAF trigger pattern where object destruction and use race across execution paths driven by remote participant input.

RemediationAI

Apply the patched Zoom Client release specified in Zoom security bulletin ZSB-26017 at https://www.zoom.com/en/trust/security-bulletin/zsb-26017; the exact minimum safe version number was not present in the source data at time of analysis and must be confirmed from the advisory directly. Enable auto-update on all Zoom clients to ensure prompt deployment of the fix. Until patching is complete, meeting hosts can reduce exposure by disabling the annotation feature at the account or group level via the Zoom Admin Portal under Meeting settings - note this removes collaborative annotation for all participants in hosted meetings, which may impact workflows. Additionally, requiring authenticated sign-in and using Zoom's waiting room to vet participants before admission narrows the attacker pool, since exploitation requires active meeting participation. Restricting meeting links to internal distribution and avoiding open/public meetings further limits attacker access to target sessions.