A major vulnerability known as “Zoomsday” has exposed a critical flaw in how Zoom handles screen sharing and interactive annotations. Discovered by researchers at cybersecurity firm A Security, the zero-day exploit chain made it possible for an attacker to hijack another meeting participant’s device without requiring a single click, link, or download from the victim. Any platform running a Zoom client—including Windows, macOS, Linux, iOS, and Android—was vulnerable to the zero-click remote code execution attack.
The issue stems from Zoom’s real-time annotation feature, which lets meeting attendees draw, highlight, and write on shared screens. Behind the scenes, Zoom relies on a proprietary direct communication protocol that sends drawing metadata between viewers and presenters. By sending specially crafted annotation data over this channel, an attacker could trigger a severe memory corruption error. Once memory was corrupted, the attacker could silently execute code on the recipient’s machine, gaining full control to access local files, deploy malware, or tap into webcams and microphones—all while the victim saw nothing unusual on screen.
What makes Zoomsday especially alarming for defenders is how easily the exploit was assembled. Using publicly available artificial intelligence tools, researchers were able to discover the bug and build a functional attack in under 24 hours using fewer than 20 prompts. A task that once required dedicated nation-state research teams months of effort can now be built in less than a day.
Zoom has since issued security patches across all affected platforms, fixing both client and server-side components. Because the attack leaves no visible trace and requires zero interaction from users, IT administrators and regular users alike are strongly urged to update their Zoom Workplace app to the latest version immediately to ensure they remain protected.
kanu priya
