Zoom Security Flaw Could Allow Device Takeover, Users Urged to Update

A security vulnerability in Zoom’s annotation feature could allow malicious actors to take over user devices, prompting urgent calls for users to update their software. The flaw was identified by security researchers who demonstrated that publicly available AI models could be used to discover and exploit the vulnerability in under a day, highlighting a concerning acceleration in the cyber threat landscape.

According to the findings, an attacker could join a Zoom meeting and exploit the annotation feature to execute malicious code on a participant’s device. The potential consequences include data theft, malware installation, and unauthorised activation of cameras and microphones, often without any visible warning signs to the victim.

Zoom has since released a security patch addressing the vulnerability across its supported platforms, including Windows, macOS, Linux, Android, and iOS. The company’s official Security Bulletin recommends all users install the latest version to benefit from the fix and other security enhancements. Zoom also maintains a software lifecycle policy that sets minimum version requirements, which will extend to its Workplace apps by August 2026.

The incident underscores the dual-use nature of artificial intelligence in cybersecurity, where the same technology that helps defenders identify and patch flaws can also enable attackers to develop exploits more rapidly. Security experts advise users to enable automatic updates, download applications only from official sources, and remain vigilant for suspicious activity during video conferences.