Zoom Patches Critical Screen-Sharing Vulnerability

A critical security vulnerability in Zoom's screen-sharing feature, which could have allowed attackers to remotely take over the devices of meeting participants, has been patched by the company. The flaw, discovered by researchers at the cybersecurity firm A Security, affected all major operating systems and required no interaction from the victim to exploit.

The vulnerability, which the researchers dubbed "ZOOMSDAY," was traced to the protocol used for real-time annotation during screen sharing. According to A Security, when screen sharing was active, the Zoom client automatically parsed all incoming data, including annotation messages. An attacker could send a specially crafted message to corrupt the memory of any participant's device and execute arbitrary code. The attack required no clicks, downloads, or other action from the victim and produced no visible warning. It could be launched by anyone on the call, whether host or participant, and worked even in meetings with end-to-end encryption enabled.

Once compromised, an attacker could steal sensitive files, activate a device's camera or microphone, deploy additional malware, and access login credentials or cryptocurrency...