CVE-2026-53415

Awaiting Analysis Awaiting Analysis - Queue

Use After Free in Zoom Client Annotator Function

Publication date: 2026-08-11

Last updated on: 2026-08-28

Assigner: Zoom Video Communications, Inc.

Description

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-28

Generated

2026-09-01

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-53415

EUVD

EUVD-2026-56245

Affected Vendors & Products

Vendor	Product	Version / Range
zoom	workplace	to 7.1.5 (exc)
zoom	workplace_vdi_client	to 7.0.11 (exc)
zoom	rooms	to 7.1.5 (exc)
zoom	meeting_sdk	to 7.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-53415 is a Use After Free vulnerability in the annotator function of Zoom Clients. This flaw could allow a malicious meeting participant to execute remote code on another participant's system through network access.

Detection Guidance

Detection of CVE-2026-53415 requires checking the installed version of Zoom products against the patched versions. For Zoom Workplace, verify if the version is below 7.1.5 or 7.0.6. For Zoom Workplace VDI Client, check if it is below 7.0.11 or 6.6.16. For Zoom Rooms, ensure the version is not below 7.1.5. For Zoom Meeting SDK, confirm the version is below 7.1.5. Use the application's built-in update feature or check the version via system settings or command line.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary code on your system during a Zoom meeting, potentially leading to unauthorized access, data theft, or further compromise of your device.

Compliance Impact

This vulnerability could lead to unauthorized remote code execution, potentially exposing sensitive data processed during meetings. Such breaches may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Zoom Workplace to version 7.1.5 or later, Zoom Workplace VDI Client to version 7.0.11 or later, Zoom Rooms to version 7.1.5 or later, and Zoom Meeting SDK to version 7.1.5 or later to patch the Use After Free vulnerability in the annotator function.

Hi! I’m here to help you understand CVE-2026-53415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70