ZOOMSDAY Zoom Annotation PDU opcode 0x10001 (AddObj) observed on AddObjAck channel - sender-role/opcode confusion

Duo Tech@duotech

•updated Aug 17, 2026•0•0•3

Suricata signature for a Zoom annotation PDU carrying opcode 0x10001 (AddObj) delivered on the downstream acknowledgement channel (which should only carry 0x10002/AddObjAck), indicating sender-role/opcode confusion that lets any participant forge presenter-privileged annotation objects (ZOOMSDAY, CVE-2026-53413/53414/53415).