Security Advisory – August, 2026: Critical Vulnerabilities in Zoom Software Running on Neat Devices

Advisory ID: NEAT-SA-2026-08-13
Publication date: August 13, 2026
Last updated: August 13, 2026

Severity: Critical (highest impact) — see table below for individual CVSS scores. Two of the three vulnerabilities score 8.3 (High) under CVSS v3.1; combined, this set of flaws allows remote code execution during a live meeting with no explicit action from the victim beyond being in the call.

CVSS vector: See table below — one vector per CVE
CVE ID: CVE-2026-53413, CVE-2026-53414, CVE-2026-53415 (see table below)

Summary

Zoom disclosed three vulnerabilities in the annotation feature used across Zoom Workplace, Zoom Rooms, and the Zoom Meeting SDK. A meeting participant can send a specially crafted annotation message to another participant’s client, triggering a memory-corruption bug that can lead to remote code execution or a client crash, without any action from the victim beyond being present in the meeting. Neat devices running Zoom Rooms software are affected.

Vulnerability Details

CVE	Issue	CVSS v3.1	Vector / CWE
CVE-2026-53413	Missing bounds check in the Zoom annotation handler allows a buffer over-write, enabling remote code execution on another participant’s client.	8.3 (High)	AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H — CWE-787 (Out-of-bounds Write)
CVE-2026-53414	Missing bounds check in the same annotation handler allows a buffer over-read, enabling a denial of service against another participant’s client.	6.5 (Medium)	AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2026-53415	Use-after-free in the annotation handler may allow remote code execution on another participant’s client.	8.3 (High)	AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Product	Affected versions	Fixed version
All Neat devices running Zoom Rooms (Neat Bar, Neat Bar Generation 2, Neat Bar Pro, Neat Board, Neat Board 50, Neat Board Pro, Neat Board 32, Neat Pad / Neat Pad Pro as controller, Neat Frame, Neat Center)	Any NeatOS release bundling Zoom Rooms Controller/Appliance software prior to version 7.1.0 (CVE-2026-53413, CVE-2026-53414) or 7.1.5 (CVE-2026-53415)	Fixed in Zoom Rooms 7.1.5. Available now in the Preview channel (August 13, 2026); Stable channel rollout is scheduled for August 19, 2026.

Impact

A participant in a Zoom meeting — including a meeting hosted or joined from a Neat device running Zoom Rooms — could send a crafted annotation message to another participant and, depending on the specific flaw, achieve remote code execution on that participant’s device or crash their client. On a compromised Neat Room device, this could enable an attacker to access the device’s camera or microphone, exfiltrate data, or use the device as a foothold into the local network. No action is required from the victim beyond being present in the meeting; this does not require the victim to open, click, or download anything.

Details

The vulnerabilities are in Zoom’s annotation feature, which lets meeting participants draw, type, or place shapes on a shared screen or whiteboard. Annotation objects are serialized into messages and routed through Zoom’s Multimedia Router to other participants, where they are deserialized and reconstructed by the receiving client. The receiving client’s deserialization logic did not correctly validate the size of certain fields before copying data into fixed-size buffers (CVE-2026-53413), read past the end of an allocated buffer (CVE-2026-53414), or reused memory after it had been freed (CVE-2026-53415), each of which is remotely triggerable by any meeting participant without needing host or presenter privileges. Zoom has also deployed a server-side mitigation, effective July 15, 2026, that filters malicious annotation messages before they reach clients — but this filter cannot inspect the content of meetings using end-to-end encryption (E2EE), since Zoom’s servers cannot see into E2EE call content by design.

Remediation

Update devices to the new Zoom Rooms versions provided in the August 13 Preview update (7.1.5). After the Preview channel update August 13, we plan on releasing these new Zoom Rooms versions to the Stable channel on Wednesday, August 19.

Interim mitigation until the update is installed: Zoom’s server-side filtering (in effect since July 15, 2026) already blocks the malicious annotation messages described here for standard meetings. If any Neat Zoom Rooms device is used in meetings with end-to-end encryption enabled, this server-side protection does not apply — administrators should avoid enabling E2EE on those rooms until the device update is installed, or disable the Annotation feature at the account or room level as an additional precaution.

Acknowledgments

CVE-2026-53413 and CVE-2026-53414 were identified and reported to Zoom by Idan Levcovich of Ⓐ Security. CVE-2026-53415 is credited by Zoom to Zoom Offensive Security; Ⓐ Security’s public research (credited to Lidor Elias) also describes independently identifying this issue. These vulnerabilities were not reported directly to Neat.

References

Contact

Questions about this advisory can be directed to security@neat.no.