Zoom vulnerabilities and fixes

CVEs that mention Zoom, ranked by priority. 6 tracked.

Zoom has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-08-18. Highest priority: CVE-2026-53413 (score 39/100).

• CVE-2026-53413 HIGH 8.3 Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a mee
• CVE-2026-53415 HIGH 8.3 Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote cod
• CVE-2026-28169 MEDIUM 5.3 Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
• CVE-2026-53414 MEDIUM 6.5 Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meet
• CVE-2026-53416 HIGH 7.1 Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosur
• CVE-2026-66641 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

FAQ

How do I fix Zoom vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Zoom being exploited right now?

None of the tracked Zoom CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Zoom CVE should I patch first?

CVE-2026-53413 currently ranks highest (39/100): Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a mee.

← Back to latest CVEs