Executive Summary

A critical zero-click remote code execution (RCE) vulnerability has been identified in the Telegram messenger application, posing a severe risk to users on Android and Linux platforms. The flaw, registered by the Zero Day Initiative as ZDI-CAN-30207, carries a CVSS 3.1 score of 9.8 out of 10. Exploitation requires no user interaction beyond the victim receiving a malicious animated sticker. Successful exploitation could allow an attacker to gain complete control over the victim's device and Telegram account. As of March 28, 2026, no patch is available, and information about a working exploit is reportedly being sold, making this a high-urgency threat.

Vulnerability Details

The vulnerability is a zero-click RCE, which is among the most dangerous classes of software flaws because it can be exploited without any action from the victim.

• Identifier: ZDI-CAN-30207
• CVSS 3.1 Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None

Exploitation is achieved by sending a specially crafted animated sticker to a target user. The vulnerability is triggered within the application's media processing library when it attempts to render the malicious sticker. This leads to a memory corruption error, which can be leveraged by an attacker to execute arbitrary code on the victim's device with the privileges of the Telegram application.

Affected Systems

• Telegram for Android: All recent versions are presumed to be affected until a patch is released.
• Telegram for Linux: All recent versions are presumed to be affected until a patch is released.

Other versions of Telegram (e.g., for iOS, Windows, macOS) are not explicitly mentioned as being vulnerable in the reports, but users should remain cautious.

Exploitation Status

The vulnerability was registered with the Zero Day Initiative on March 26, 2026. According to reports circulating within Telegram channels, information about the vulnerability and a working exploit/generator are already being sold on underground markets. This indicates that the flaw may be on the verge of active exploitation, if not already being used in targeted attacks. Full technical details are scheduled for public disclosure after July 24, 2026, under responsible disclosure policies, giving Telegram a window to develop and deploy a fix.

Impact Assessment

A successful exploit would have a devastating impact on a victim's privacy and security. An attacker could gain full control over the Telegram application, allowing them to:

• Read all past and future private and group messages.
• Send messages on the victim's behalf.
• Access the victim's contact list.
• Potentially pivot from the compromised application to gain further access to the underlying device, stealing other sensitive data such as photos, files, and credentials for other services.

Given Telegram's use by journalists, activists, and government officials, this vulnerability poses a significant risk for espionage and targeted surveillance.

Cyber Observables for Detection

Detecting exploitation of a zero-click vulnerability is extremely difficult without access to endpoint or network telemetry. However, organizations can hunt for potential indicators.

Detection Methods

• Endpoint Monitoring: Use an EDR or Mobile Threat Defense (MTD) solution to monitor the Telegram process for anomalous behavior, such as unexpected network connections, file system access outside of its sandbox, or the spawning of suspicious child processes (e.g., a shell).
• Network Analysis: While traffic is typically encrypted, monitoring for connections from Telegram to unusual IP addresses or domains could be an indicator of compromise post-exploitation. This is difficult but may be possible if the attacker's C2 infrastructure is known. Reference D3FEND technique D3-NTA - Network Traffic Analysis.

Remediation Steps

As of March 28, 2026, no patch is available.

Immediate Workarounds & Mitigations:

1. Disable Auto-Download: In Telegram's "Data and Storage" settings, disable the automatic download of all media types (photos, videos, files) over both mobile data and Wi-Fi. This may reduce the attack surface by preventing the malicious sticker from being processed automatically, though it is not a guaranteed fix.
2. Limit Communication: Be extremely cautious about receiving messages, especially media files, from unknown or untrusted contacts.
3. Monitor for Updates: Constantly check the Google Play Store or Telegram's official website for a new version of the application and install it immediately once it becomes available.
4. Use an Alternative Messenger: For highly sensitive communications, consider temporarily switching to an alternative end-to-end encrypted messenger until a patch is confirmed to be effective.

Once a patch is released, applying it via the official app store is the only effective remediation. Reference D3FEND hardening technique D3-SU - Software Update.