A participant in your Zoom meeting could take control of your machine. Exploitation took fewer than twenty prompts, those instructions given to an AI.

On Monday, an Israeli security company published details of a Zoom vulnerability dubbed Zoomsday. The principle is simple: someone in the same meeting as you can execute code on your machine. You don't click anything. You don't download anything. You simply join the meeting.

Five colleagues and a guest. Nobody noticed anything; he was wearing a headset like everyone else.

Zoom has fixed the vulnerability, and the official bulletin is worth a look. Bulletin ZSB-26015 references the vulnerability under the number CVE-2026-53413. It is rated High, with a score of 8.3 out of 10. The description fits into a single sentence of rather chilling sobriety: the annotation function does not properly check memory boundaries. A participant can therefore write data to the wrong place and, from there, execute code on another participant's machine.

The annotation function is the little pencil used to doodle on the shared screen while your boss presents his pie charts.

How to get in through the pencil

The mechanism is almost insultingly simple. I expected something obscure. Not at all.

When you draw a red circle on the shared screen, Zoom does not send an image. It sends a description of the object: a circle, a color, and coordinates. This data is serialized, meaning arranged in a format the software can transmit. It passes through Zoom's server, then the client on the other end deserializes it, meaning it reads it back, to redraw the circle. Classic. Effective.

The researchers found the problem in this protocol. An acknowledgment can also carry an object. The software receiving it opens that object without checking whether the sender has permission to send it.

The little note says “received, thank you.” The twenty-kilo package taped underneath says nothing.

In the real world, imagine an A5 sheet that says “received, thank you.” Someone has taped a twenty-kilo package underneath it, and your mail carrier opens it for you without checking the sender. That's the vulnerability.

Next, you have to build the exploit, and it is not a three-line script. The official vector indicates AC:H, which means the attack is complex. On macOS, the researchers crashed Safari by exceeding the boundaries of a memory region called the stack. On Android, they manipulated another region, the heap, to modify pointers that tell the program which code to execute. They managed to do this without even knowing in advance the addresses used in memory. If you've lost track, remember this: the initial mechanism is simple, but exploiting it requires considerable expertise.

And that's where it really hurts

This feat of craftsmanship was accomplished in less than twenty-four hours. With fewer than twenty prompts, meaning fewer than twenty instructions given to publicly accessible AI models.

The researchers do not name the models. They only refer to “publicly accessible state-of-the-art models.” However, they detail the steps. That list is what made me put down my coffee:

• First prompt: identify exploitable points in 121 native libraries, components executed directly by the system.
• Second: understand the annotation protocol by analyzing how it works internally.
• Third: examine the code that reads the received data to look for memory errors.
• Fourth: craft the malicious packet and send it through Zoom's actual communication system.
• Fifth: hijack program execution on macOS using small pieces of code already present in memory.

Vulnerability discovered on June 8. Code execution confirmed on the 9th. Problem reported to Zoom on the 10th. One person, one long weekend, and a vulnerability affecting Windows, macOS, iOS, and Android.

The budget on the left fit in a safe. The one on the right fits in a monthly subscription.

Just two years ago, this kind of research required a government team, months of work, and a budget one would rather not disclose. The researchers say it plainly: the barrier that made these weapons rare has collapsed, and it is not coming back.

Now, let's not get carried away. You still had to know what to ask, and in what order. The five prompts above are not the questions of a Sunday curiosity seeker. They are the work plan of someone who knows exactly what they are looking for. The AI did not come up with the idea. It carried out the painstaking work that previously took six months. That is still enormous.

The term « zero-click » and everyone's little lie

All the press ran the headline « zero-click », in other words, an attack that requires no click from the victim. That is what I thought too when I read it. Except that the official vector published by Zoom says otherwise:

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Look at UI:R. This code means « user interaction required ». Technically, then, this is not zero-click.

Except that the requested interaction consists of joining the meeting. Nothing more. You click the link for the 9 a.m. appointment, and you have done your part. Both interpretations are defensible. I would rather give you the exact code than the catchy term.

Another nuance: the attacker must be in the meeting. They can join it or host it, but they must be present. The attack therefore cannot come from just anyone on the Internet. That said, if you host webinars with a public link or accept unknown guests, the difference becomes fairly theoretical.

What you do this morning, in two minutes

Two minutes, and you can get back to your coffee.

Open Zoom. Click your profile picture in the top right, then click Vérifier les mises à jour. If your version is earlier than 7.1.5, update it from the download page. The SDK is the kit used to integrate Zoom into an application. The VDI client is intended for virtual desktops. According to the bulletin, the fixed versions are as follows:

Zoom Workplace          7.1.5  ou  7.0.6
Zoom Rooms              7.1.0  et au-dela
Zoom Meeting SDK        7.1.0  et au-dela
Zoom VDI Client         7.0.11 ou  6.6.16
Zoom VDI Plugins        7.0.11 ou  6.6.15

If you host open meetings, also go into the settings and disable annotation when you don't need it. Two clicks, and you remove the entry point for this entire family of bugs. Not just this one.

Two pieces of good news, all the same. Zoom implemented a protective measure on its servers as early as July 15. Clients that weren't yet up to date therefore weren't completely left exposed over the summer. Two other flaws in the series are also less serious: CVE-2026-53414 merely crashes a participant's client, and CVE-2026-53416 only affects VDI clients, which you have probably never installed.

And if you don't use Zoom, it still affects you

This isn't just a Zoom story. It's a story about cost.

Your Internet router, your smart TV, the camera installed in your garage, or your phone's banking app all contain old code. And that code may be missing a check. These bugs have always existed. What has changed is the price of finding them.

Before, a bug like this could lie dormant quite peacefully. No one necessarily had six months and a team to devote to videoconferencing software. Now, a skilled tinkerer and a Sunday may be enough. So we'll find more vulnerabilities, which will lead to more updates. Sorry, but you'll have to stop putting off “Install later” for three weeks.

It makes me think of lock picking. For a century, you had to learn the technique. Then tutorials and ten-euro tools became accessible to everyone. The lock industry had to wake up. No one regretted it: today's locks are much better than those from 1990. But the transition years were unpleasant.

We're in those few years now.

What I think

The technical side is brilliant, and I take my hat off to them. Reported on June 10, a fix for clients on the 22nd, server-side protection in July, then disclosure on August 11: everyone worked in the right order. That deserves to be said, precisely because it so rarely is.

What troubles me is the researchers' statement about the collapsed barrier. Their answer is to use this same capability against their own software, continuously, before someone else does it. On paper, it's unbeatable. In practice, vendors need the means and the willingness to adopt this reflex. For every Zoom that fixes a flaw in twelve days, there's a camera brand that will never answer your email.

So yes, I'm going to update Zoom. And I'll look at my own little gadgets differently, because whoever finds a flaw in them will no longer need six months. Just a Sunday and a cup of coffee.