Loading story…
A vulnerability disclosure tracked as ZDI-CAN-30207 alleges that Telegram for Android and Linux contains a critical zero-click remote code execution flaw that could let an attacker take over a device by sending a specially crafted animated sticker. The reported issue, credited to researcher Michael DePlante of TrendAI Zero Day through the Zero Day Initiative, was described with a CVSS score of 9.8 and said to trigger during automatic sticker preview generation, requiring no user interaction.
Telegram has publicly denied that the vulnerability exists, saying stickers are validated server-side before delivery and that code execution through stickers is technically impossible. Italy’s National Cybersecurity Agency (ACN) published a notice about the alleged 0-click issue and later reflected Telegram’s denial, while technical details remain withheld and no patch has been released as the vendor is given time to address the claim by July 24, 2026; there is also no confirmation of exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Telegram formally denied that the reported vulnerability exists, stating that stickers are validated server-side before delivery and that code execution through stickers is technically impossible. Italy's National Cybersecurity Agency published an update reflecting Telegram's denial.
Researcher Michael DePlante of TrendAI Zero Day reported an alleged Telegram vulnerability through the Zero Day Initiative, describing it as a critical zero-click remote code execution flaw affecting Telegram on Android and Linux. The issue was said to allow device takeover via a malicious animated sticker processed during preview generation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a security update in November 2025 to address a critical remote code execution vulnerability, CVE-2025-48593, in the Android System component. This flaw allows attackers to execute code remotely on affected devices running Android versions 13 through 16 without requiring user interaction or additional execution privileges. The vulnerability stems from insufficient validation of user input, making it possible for exploitation via a zero-click attack vector. The update also addressed a separate privilege escalation issue, CVE-2025-48581, affecting Android 16, but the primary concern is the zero-click RCE, which requires immediate patching due to its severity. Google has stated that there is no evidence of active exploitation in the wild at the time of the update. Security experts urge all users and organizations to apply the November 2025 security patch promptly to mitigate the risk posed by this critical vulnerability.
Jun 29, 2026
Zoom has patched four vulnerabilities, including a severe zero-click remote code execution flaw tracked as **CVE-2026-53413** that could let a meeting participant silently take over another participant’s device during calls involving screen sharing and annotation. Researchers reported that the bug stemmed from memory corruption in Zoom’s annotator protocol and required no victim interaction or visible warning, affecting Zoom clients across all supported platforms. The issue was disclosed alongside broader concerns that anyone on a call could exploit the screen-sharing workflow to compromise another device. The vulnerabilities, branded **"Zoomsday"** by security firm A Security, also included annotation-related denial-of-service and use-after-free flaws, while Zoom separately fixed **CVE-2026-53416**, a path traversal information disclosure bug in the Workplace VDI Client and VDI Plugins. Zoom released patches in the **7.1.5** series for Workplace, Rooms, and Meeting SDK products, and the disclosure also drew attention because researchers said they used a public AI tool and fewer than 20 prompts to help identify the bug.
Aug 21, 2026
Calif disclosed **WeWorm**, a proof-of-concept zero-click worm that exploited a memory-corruption vulnerability in WeChat’s VoIP call-handling stack. A malicious voice call could reportedly compromise a WeChat account within seconds while the phone rang, without the recipient answering or interacting. The researchers demonstrated propagation from a Pixel 10a to an iPhone 17e and then another Pixel device, using compromised accounts to call saved contacts across Android and iOS. Successful exploitation reportedly gave attackers control of the victim’s WeChat account, including access to messages and the ability to send messages, place calls, and impersonate the user; it did not by itself provide full device takeover. Calif reported the flaw to Tencent on July 24, and Tencent mitigated it for users on August 21 before public disclosure. Calif estimates that, absent remediation, WeChat’s scale could have made more than one billion accounts or devices exposed to wormable account compromise, while withholding technical details pending a future conference presentation.
Sep 11, 2026