Zoom has released patches addressing four newly disclosed vulnerabilities that allow a malicious participant to remotely execute code on another attendee's device without requiring clicks, downloads, or notifications This article explores zoom released patches. . Zoom disclosed three related issues in the same bulletin cycle: CVE-2026-53413, rated medium severity, is a buffer over-read bug that leaks memory contents; CVE-2026-53414 is a use-after-free vulnerability with high severity, which can result in memory corruption and potential code execution if an attacker triggers access to freed memory.
Zoom’s Virtual Desktop Infrastructure (VDI) Client faces a vulnerability due to a path traversal weakness rated high, which could expose sensitive files by allowing an attacker to manipulate file paths outside intended directories.
Fixes for these issues have already been implemented: Zoom Workplace versions 7.1.5 and 7.0.6, Zoom Rooms 7.1.5, and Meeting SDK 7.1.5 resolve the annotation flaws, whereas Workplace VDI Client versions 7.0.11 and 6.6.16, along with VDI Plugin versions 7.0.11 and 6.6.15, address the path traversal bug. Organizations managing centralized Zoom deployments should immediately push updated installer packages rather than relying on users to manually update them to prevent vulnerable builds from silently reappearing in subsequent install cycles.
