Looks like there's a bit more info on the zero-click Telegram RCE and holy shit this looks bad:
> This vulnerability allows an attacker to execute arbitrary code on a victim's device simply by sending a specially crafted animated sticker or media file. No user interaction is required
> A Telegram spokesperson denied the vulnerability's existence, claiming the research was incorrect.
https://github.com/gameworkerkim/Telegram-0-Click-RCE-SECURITY-VULNERABILITY-ANALYSIS-REPORT/blob/main/Telegram%200-Click%20RCE_ENG.md
#telegram #security
Wolf480pl
npub170…ut88d
2026-03-30 13:38:14 UTC
Author Public Key
npub170403ynslsp4tn32j8tfhjn3cdq2pgut0jpnhrlcxl524gxf36pqput88dSeen on
wss://relay.ditto.pubPublished at
2026-03-30 13:38:14 UTCEvent JSON
{
"id": "bf79be6756d0c21cba88b7bb9cd7ca33d96bf73eb64eb4f9e939751ce8615d8a",
"pubkey": "f3eaf89270fc0355ce2a91d69bca71c340a0a38b7c833b8ff837e8aaa0c98e82",
"created_at": 1774877894,
"kind": 1,
"tags": [
[
"t",
"telegram"
],
[
"t",
"security"
],
[
"proxy",
"https://mstdn.io/users/wolf480pl/statuses/116318397690228248",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Looks like there's a bit more info on the zero-click Telegram RCE and holy shit this looks bad:\n\n\u003e This vulnerability allows an attacker to execute arbitrary code on a victim's device simply by sending a specially crafted animated sticker or media file. No user interaction is required\n\n\u003e A Telegram spokesperson denied the vulnerability's existence, claiming the research was incorrect.\n https://github.com/gameworkerkim/Telegram-0-Click-RCE-SECURITY-VULNERABILITY-ANALYSIS-REPORT/blob/main/Telegram%200-Click%20RCE_ENG.md\n\n#telegram #security",
"sig": "dd902192de86825454ab237f72263fea45ac21e298ec77b4a5969bab137a3270ea7684d0c80c544b0a49f855b1a20e48ff26a0f6824a85ee235bbf30b8667aa3"
}