Neoverse Autonomous Research Agents Uncover Critical Remote Code Execution Flaw in Zoom
Autonomous analysis of previously patched library reveals remote attack path validated by Neo researchers across four
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
BOSTON, Nov. 12, 2026 (GLOBE NEWSWIRE) — Neo, the AI security control platform, today announced that Neoverse autonomous software research agents identified an exploitable vulnerability in Zoom despite it being patched earlier this year. The agents investigated a vulnerable third-party library patched in February 2026 and determined that the flaw was still reachable across macOS, Windows, iOS and Android. Exploitation via memory corruption enables remote code execution during Zoom phone calls. Zoom has released fixes for all four platforms.
The findings demonstrate the power of Neo’s autonomous research capabilities, which have already analyzed and delivered security verdicts on more than 4 million AI applications in Neoverse. Neoverse utilizes autonomous agents to examine commercial software without source code, determining what each application contains, what it can do, what risk that represents, and whether it merits further investigation. The Neoverse software intelligence engine identifies and analyzes each individual AI component. Agents ingest this intelligence and apply it to specific environments, mapping potential attack paths to provide human researchers with specific, evidence-backed findings for further investigation.
“A fix that exists upstream is not a fix on your device,” said Shlomi Salem, CPO and co-founder of Neo. “The patch for this flaw was public for months, yet it was still exploitable in Zoom on four platforms. Our agents found it, mapped the attack path, and handed our researchers the proof. That is the promise of autonomous research: seeing inside every piece of software an enterprise runs, so organizations can embrace AI with confidence.”
From an embedded component to a confirmed attack path
Neoverse identified pjproject 2.14.1 inside Zoom’s communications stack, a version that predates the fix for CVE-2026-25994, a buffer overflow in the library’s ICE credential handling. A fix was published in February 2026, months before Neo identified the vulnerable component in Zoom on August 30.
Despite the patch, Neoverse agents not only matched a component to the known vulnerability but mapped the attack path: a remote call participant could access the vulnerable function through Zoom’s code without the necessary length validation. Neo researchers validated the exploit, determining that successful exploitation could allow an attacker to execute arbitrary code on the recipient’s device.
Autonomous research into the software enterprises actually run
Neo analyzes shipped software holistically, including the embedded components that make up an agent but are often obfuscated and difficult to identify in conventional inventories. For the Zoom investigation, Neoverse combined published open-source attribution data with binary analysis to determine which library version was present and whether the vulnerable code was reachable. Neo utilizes this approach to evaluate agentic software before it is deployed, identify potentially vulnerable components, and flag any changes introduced by updates. Neoverse analyzes every newly added AI feature in real time, establishing what it can do, what it can access, and whether it acts independently or requires human approval.
The Neoverse intelligence engine delivers findings across desktop applications, IDEs, browser extensions, MCP servers and agent skills. The resulting verdicts drive the Neo platform’s decisions, establishing and enforcing policy to govern agentic activity across the enterprise.
Neo reported the findings to Zoom on August 30. Zoom acknowledged the report and released updated clients for Windows, macOS, iOS and Android in September, and issued a security bulletin. Versions earlier than 7.2.0 are affected; users should update to version 7.2.0 or later.
For the full Zoom research report, visit neo.ai/blog/zoom-rce. To learn more about Neo, visit www.neo.ai.
About Neo
Neo is AI security that starts on the device. The Neo platform gives security teams the inventory, intelligence, attribution, and policy control required to govern agentic software across AI agents, AI-enabled applications, browsers, identities, and traditional software as enterprise applications become autonomous. Founded by SentinelOne veterans and backed by Andreessen Horowitz, Bessemer Venture Partners, Craft Ventures, and Merlin Ventures, Neo enables organizations to adopt AI securely while maintaining the visibility and control required to manage risk across the enterprise. For more information, visit neo.ai.
Media contact:
Will Clark
Marketbridge for Neo
Neo@marketbridge.com
Media gallery
