The researchers said an attacker could send annotation data to a participant's Zoom client, after which the client would process that data automatically, even if the recipient did not click an annotation, approve remote control, or open a file. These bugs could let an attacker run code with the same permissions as the Zoom app.