Heap disclosure via short annotation glyph body

Buffer over-read in Zoom Clients allows remote attackers to expose heap data through crafted meeting annotations sent over a network. The glyph-buffer parser allocates from a sender-controlled character count, copies only the short packet body, and leaves the unread tail as live uninitialized heap memory. Exploitation requires participation in the same meeting; the leak exposes pointers useful for bypassing ASLR but does not itself execute code.