Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client

A Security, an Israeli offensive-security startup, discovered three Zoom vulnerabilities that could allow a meeting participant to hijack another attendee’s computer. The flaws, including a buffer over-write and a use-after-free, were found in Zoom’s annotation tool and could be exploited with minimal interaction from the attacker. While Zoom initially rated the vulnerabilities lower, A Security’s research demonstrated a working exploit within a day using publicly available AI models, highlighting a significant gap in Zoom’s internal assessment and a lowered barrier to exploit development.