Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

This RCE affecting Zoom has been dubbed Zoomsday. Patches are available for all supported platforms and should be applied as soon as possible.

The version of Zoom Workplace installed on the remote host is prior to 7.1.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-26015 advisory.

  - Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a     meeting participant to achieve remote code execution of another participant via network access.
    (CVE-2026-53413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26015 advisory.

  - Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a     meeting participant to achieve remote code execution of another participant via network access.
    (CVE-2026-53413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
337874	Zoom Workplace < 7.1.0 Vulnerability (ZSB-26015)	Nessus	Windows	Local	high
337873	Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26015)	Nessus	Windows	Local	high
334489	Zoom Workplace < 7.1.0 Vulnerability (ZSB-26015)	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53413

high

Tenable Plugins

high

high

high