Zoom Annotation Exploit | Install Malware on Participants

[Kurupt®]

1. Join (or host) any Zoom meeting — a public meeting ID, a leaked invite link, or a hijacked session all work
2. Start screen sharing and open the annotation tool (the annotation protocol opens a direct channel to every participant)
3. Send a specially crafted annotation message through the proprietary annotator protocol
4. The victim's client parses it automatically — no interaction needed — and the missing bounds check overflows a heap buffer
5. Attacker-controlled data overwrites memory and redirects execution flow
6. Payload runs with the victim's user privileges → reverse shell, keylogger, camera/mic access, ransomware

Full Exploitation Steps
Prerequisites (dead simple):
- Any Zoom Workplace client that's not updated (target machine)
- Meeting access — a public/personal meeting ID or leaked invite works
- The annotation feature enabled during screen share (default on)

Understanding the bug:
The vulnerability lives in Zoom's annotation engine — a closed-source proprietary library (libannotate.so on desktop, and its equivalents on mobile). When someone shares their screen and a participant draws on it, the annotation system uses a proprietary protocol to relay those drawing commands to every other client in real time.

The protocol opens a direct channel between a viewer and a sharer. Every Zoom client trusts and automatically parses whatever it receives over that channel. The flaw is a missing bounds check in the text annotator function (CWE-787, out-of-bounds write): a crafted annotation message writes attacker-supplied data past the intended heap buffer, letting the attacker control execution flow on the receiving machine.

Zoom's annotation flow:
1. Attacker shares screen and enables annotation
2. Zoom's proprietary annotator protocol establishes
a direct channel: attacker <-> each participant
3. Attacker sends a drawing/text annotation message
4. Receiving clients call libannotate's annotator function
and parse the message with NO bounds check
5. The oversized field overflows a heap buffer
6. Attacker-controlled bytes land past the buffer,
corrupting adjacent heap structures / function pointers
7. Execution flow is redirected to attacker code

Exploitation — corrupting the receiving client:
Step 1: Get into the meeting
- Target a meeting with a public ID (common in webinars,
online classes, public town halls)
- Or leak an invite link from a calendar, forum, or email
- Host privileges are NOT required to annotate in most
default configs — any participant can draw

Step 2: Enable screen share + annotation
- The annotation channel only opens during screen sharing
- Attacker shares their own screen (or a blank window)
- Annotation becomes available to the whole meeting

Step 3: Send the malicious annotation message
- The text annotator accepts a text string with its
length/coordinates in the message header
- Craft a message where the declared length exceeds the
actual allocated buffer (missing bounds check)
- The oversized payload is written past the buffer

Step 4: The victim's client gets owned
- Every other client in the meeting receives and parses
the crafted message automatically (zero interaction)
- Heap corruption → control of RIP/PC
- ROP chain / shellcode in the payload executes
- No warning, no UI prompt, no crash on success

Targeting every participant individually:
The proprietary protocol routes annotations directly between each viewer and the sharer, so the attacker can single out one specific participant and hit them with a payload tuned to their platform — or blast everyone in the meeting with a multi-platform chain.

Per-target delivery:
- Windows/macOS/Linux desktop → heap spray + ROP chain
- iOS/Android mobile → platform-specific libannotate build
- Same bug class, same logic, compiled identically across
all platforms (libannotate.so is a shared codebase)
Post-exploitation — what a popped Zoom client gives you:

Payload runs with the victim's user privileges:
1. REVERSE SHELL:
- Windows: PowerShell TCP reverse shell
- macOS/Linux: /bin/sh or /bin/bash reverse shell
- Callback to attacker C2, fully interactive

2. SURVEILLANCE:
- Activate the webcam and microphone silently
- Zoom is already in the meeting — mic/cam access is granted
- Record the victim's screen, meetings, and surroundings

3. CREDENTIAL & DATA THEFT:
- Browser cookies, saved passwords, session tokens
- Zoom's own config (SSO cookies, meeting history)
- Documents, emails, chat logs

4. PERSISTENCE:
- Install a startup key, launch agent, or scheduled task
- Plant a keylogger or stealer
- Keep a backdoor for later access

5. LATERAL MOVEMENT:
- The compromised device sits on the corporate network
- Harvest VPN/domain creds and move sideways
- One infected meeting attendee = entry into the whole org

Scale of impact:
A single attacker can join one meeting — a town hall, an all-hands, a vendor kickoff, a university lecture — and silently own every device that attends. No one clicks anything. No one gets a warning. By the time the meeting ends, the attacker has a fleet of compromised machines.

Quote:Real-world scenario: Attacker finds a company's weekly all-hands Zoom link posted in a public calendar or on a scraper forum. They join the call as "IT Support," share a blank screen, enable annotation, and push a crafted annotation message to the CEO's laptop. The CEO never touches a thing — the client parses it automatically. Minutes later the attacker has a shell on the CEO's machine and a foothold in the corporate network, including every other participant who stayed on the call.

Affected components:

• Zoom Workplace clients (Windows, macOS, iOS, Android, Linux)
• Zoom Workplace VDI Client for Windows
• Zoom Rooms (all platforms)
• Zoom Meeting SDK (all platforms)

Note: End-to-end encrypted (E2EE) meetings are even juicier targets — the server can't inspect E2EE traffic to filter out malicious annotation messages, so nothing stands between the crafted packet and the victim's client.