Zoom Fixes Critical Security Flaw That Could Let Attackers Remotely Control Users' Devices

Cybersecurity researchers have discovered a critical vulnerability in Zoom that could allow attackers to control another user's device during a live call. The flaw is said to be linked to Zoom's screen-sharing feature. This latest bug seems to have affected the Zoom app across all operating systems. The vulnerability exists in all versions up to and including 7.0.5. The researchers confirmed that Zoom was informed about the bug and has deployed various fixes to mitigate the threat. The researchers claimed that they developed a working exploit using fewer than 20 prompts with publicly available AI models.

Zoom Security Flaw Puts Users at Risk

Security researchers at A Security discovered a critical flaw in Zoom that could allow an attacker to take full control of another user's device during a live meeting without any action from the victim. The latest blog post shared on the company website states that the vulnerability is a memory-corruption bug that exploits Zoom's annotation feature.

Researchers at A Security claim that the bug affects Zoom clients on Windows, macOS, iOS, Android, and Linux with versions before 7.1.5. Zoom clients using end-to-end encryption settings in version 7.0.6 also remain affected. Once exploited, attackers can either join or host a meeting, target any participant, and take over their machine with no required action from the victim and no visual cue indicating the compromise.

The threat actor can steal personal data, switch on the microphone or camera to spy on the target, or install other malicious software once the nefarious code is running on the victim's device.

The researchers said the entire operation, including finding the flaw and building a working exploit, "was carried out using fewer than 20 prompts on publicly available AI models in under 24 hours".

The platform states that it has collaborated with Zoom to address the issue and reported the vulnerability to Zoom in June THIS year. The vulnerabilities are listed as CVE-2026-53413, CVE-2026-53414 and CVE-2026-53415, and Zoom has acknowledged receipt and released fixes. The cloud-based video conferencing and communication platform says, "Users can help keep themselves secure by applying the latest updates."