Zoom Clients CVE-2026-53415

The victim must be an active participant in the same Zoom meeting as the attacker, and the annotator feature must be accessible or in use during that session - this is the specific product feature identified in the CVE description as the attack surface. The CVSS UI:R indicates the victim's client must process the attacker's annotation data, which may require annotation to be enabled by the meeting host (a host-controlled permission in Zoom settings). Exploitation is bounded to the duration of a shared active meeting session, meaning opportunistic drive-by attacks outside a meeting context are not possible. AC:H imposes a further practical barrier: heap-grooming or precise memory-lifecycle timing must be achieved to control freed memory contents reliably. Factors limiting exploitation: attacker must share a meeting with the specific target; annotation must be enabled (non-default-off configuration depending on account settings); UAF exploitation complexity is high; and the attack window is constrained to live meeting sessions only.

The CVSS 8.3 High rating with S:C (scope changed) reflects the cross-boundary nature of the impact: the attacker operates in their own meeting session context but achieves RCE on a different participant's device. AC:H accurately captures the heap-grooming or timing precision required to reliably exploit a UAF - this is not a push-button flaw and limits commodity exploitation. PR:N confirms that no elevated meeting role (host or co-host) is required; any participant can attempt the attack. No EPSS score was provided in source data, so exploitation probability cannot be quantified from that signal. No KEV listing was identified, and no public POC is known at time of analysis. The real-world risk profile is therefore a high-severity, moderate-probability targeted threat: a skilled attacker who can join a meeting with their target and execute reliable heap manipulation could achieve full device compromise. The AC:H rating and meeting-session prerequisite substantially reduce ambient internet-wide risk compared to a purely unauthenticated, low-complexity flaw in an internet-facing service.

An attacker joins a Zoom meeting to which the target is also a participant, then triggers annotator interactions - such as initiating shared annotation on a shared screen - and sends specially crafted annotation protocol data designed to induce a use-after-free in the victim's Zoom client heap. After performing heap grooming to control the contents of the freed memory region, the attacker redirects execution to arbitrary code, achieving full RCE on the victim's machine within the meeting session. No public proof-of-concept exists at time of analysis; the AC:H CVSS rating reflects that reliable exploitation requires significant heap manipulation skill beyond script-kiddie capability.