Cybersecurity researchers have discovered a dangerous vulnerability in Zoom that allowed a video call participant to silently run code on another participant’s device. According to the A Security team, it took them less than a day and less than 20 queries to publicly available AI models from finding the bug to creating a working exploit. Zoom has since fixed the issue.
Cybersecurity researchers have discovered a dangerous vulnerability in Zoom that allowed a video call participant to silently run code on another participant’s device. According to the A Security team, it took them less than a day and less than 20 queries to publicly available AI models from finding the bug to creating a working exploit. Zoom has since fixed the issue.
This was reported by the A Security team.
The vulnerability, which the researchers dubbed Zoomsday, was hidden in the annotation feature, a tool that allows users to draw on top of a screen, add text, arrows, shapes, and other markup while it is being shown.
For example, when a user draws something on a shared screen, Zoom sends data describing the drawing to the other device, not the finished image. The program on the other participant’s device automatically processes it. The researchers found that Zoom did not adequately check whether the amount of data received exceeded the allowable size.
So the attacker could send more data through annotations than Zoom was prepared to process. Due to the error, the program wrote excess data to a neighboring memory area, which ultimately allowed the execution of their own code on someone else's device. The researchers say that after a successful attack, it was possible, for example, to steal data, install malware or gain access to the camera and microphone.
The researchers gave the AI decompiled application code and asked it to find features through which one meeting participant could potentially influence another's device. The agent then focused on the annotation mechanism and helped the researchers understand how Zoom transfers annotation data between meeting participants, as well as how an attacker could create an exploit.
“Defenses designed for a world where such weapons were few are no longer effective. The only reliable way to counter them is to direct those same capabilities inward, constantly checking your own environment before an attacker can penetrate it,” A Security emphasizes.
Yesterday, dev.ua reported on GPT-5.6-Cyber, a new OpenAI model for cybersecurity professionals that can search for vulnerabilities and create and verify exploits. During testing, it found two previously unknown bugs in the V8 engine used in Google Chrome.
Comment hidden for violating commenting rules.
Comment hidden for violating commenting rules.
Security researchers often highlight how software vulnerabilities can allow attackers to gain unauthorized access to devices, making users more aware of the importance of downloading applications from reliable sources. When exploring multimedia apps, users can also learn more about safe installation practices alongside resources such as VidMate Free Download, helping them make informed choices while protecting their devices. https://vidmate.ph/