gameworkerkim/telegram-0-click-rce-security-vulnerability-analysis-reportI have submitted a report on the Telegram sticker vulnerability, SECURITY VULNERABILITY ANALYSIS REPORT Telegram 0-Click RCE vulnerability ZDI-CAN-30207 | CVSS 9.8 CRITICAL.
ZDI-CAN-30207 | CVSS 9.8 CRITICAL | Unpatched (as of 2026-03-30)
Author: Dennis Kim (@gameworkerkim)
Date: March 30, 2026
Contact: [email protected]
This is a zero-click remote code execution (RCE) vulnerability in the Telegram Android/Linux platforms, for which CSIRT Italy of the Italian National Cybersecurity Agency (ACN) issued an official alert in late March 2026. It was discovered by researcher Michael DePlante (@izobashi) of Trend Micro's Zero Day Initiative (ZDI) and assigned the internal identifier ZDI-CAN-30207.
This vulnerability allows an attacker to execute arbitrary code on the victim's device simply by sending a crafted animated sticker or media file to the victim. No action by the user (clicking, accepting a download, etc.) is required, making it one of the most dangerous vulnerability types in the messenger security field.
| Item | Details |
|---|---|
| Vulnerability Identifier | ZDI-CAN-30207 (No CVE assigned) |
| CVSS v3.1 Score | 9.8 / 10 (Critical) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Vulnerability Type | Zero-Click Remote Code Execution (RCE) |
| Discoverer | Michael DePlante (@izobashi) / Trend Micro ZDI |
| Affected Platforms | Telegram Android, Telegram Linux |
| Telegram Notification Date | March 26, 2026 |
| Scheduled Disclosure Date | July 24, 2026 (ZDI standard 90-120 day policy) |
| Patch Status | ⚠️ Unpatched (No official patch as of 2026-03-30) |
| PoC Disclosure | Not disclosed (Private exploit may exist) |
| Confirmed In-the-Wild Exploitation | Unconfirmed (No confirmed in-the-wild exploitation) |
| CSIRT Alert | Official alert issued by CSIRT Italy (ACN) |
The core of the attack lies in the process by which Telegram automatically generates previews for received media files (especially animated stickers). During this parsing stage, a crafted file triggers a vulnerable code path that leads to RCE.
공격 흐름:
1. 공격자 → 피해자에게 조작된 애니메이션 스티커/미디어 파일 전송
2. Telegram 앱이 메시지 수신 즉시 자동으로 미리보기 생성을 위한 파싱 시작
3. 파싱 과정에서 조작된 데이터가 취약점을 트리거 → 메모리 오염 또는 타입 혼동 발생
4. 공격자의 코드가 Telegram 프로세스 권한으로 실행됨
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector (AV) | Network | Remotely exploitable over the internet |
| Attack Complexity (AC) | Low | No special conditions or complex bypass techniques required |
| Privileges Required (PR) | None | No attacker account or special privileges required |
| User Interaction (UI) | None | No action by the victim required (Zero-Click) |
| Scope (S) | Unchanged | Impact confined within the vulnerable component |
| Confidentiality (C) | High | Full compromise of confidentiality including messages, sessions, and media |
| Integrity (I) | High | System files and data can be tampered with |
| Availability (A) | High | Service disruption and compromise of device availability |
Telegram's rlottie library (an animated sticker rendering engine) has a history of numerous similar vulnerabilities (Heap Buffer Overflow, Stack Overflow, Type Confusion) discovered in its Android/iOS/macOS versions by the Shielder research team in 2021. Those vulnerabilities required minimal user interaction, but ZDI-CAN-30207 is far more severe in that it achieves a complete zero-click.
Telegram rlottie GitHub
⚠️ Most commits are from 7 years ago, indicating an absence of ongoing maintenance.
rlottie was developed in C++14, and due to the nature of modern C++, its high level of abstraction makes debugging difficult. The fact that most commits in the GitHub source code date back 7 years suggests that the lack of continuous maintenance is not unrelated to the emergence of this vulnerability.
Telegram has over 1 billion active users worldwide.
| Category | Details |
|---|---|
| Confirmed affected platforms | Telegram for Android, Telegram for Linux |
| Potential impact unconfirmed | iOS, Windows, macOS versions |
| Affected targets | All users who receive messages from unspecified senders via Telegram |
A complete zero-click RCE vulnerability with a CVSS score of 9.8 has historically been a prime target for state-sponsored cyber attack groups (APTs) and commercial spyware developers (such as NSO Group).
⚠️ Important: Disabling auto-download does not block this vulnerability.
The vulnerability is triggered not at the file execution stage after download completes, but at the preview parsing stage that occurs automatically upon message receipt. Disabling auto-download in settings does not constitute an effective mitigation.
To date, Telegram's official side has maintained a highly unusual silence. ZDI notified Telegram of the vulnerability on March 26, 2026, and in accordance with standard Responsible Disclosure procedures, set July 24, 2026 as the disclosure deadline.
A Telegram spokesperson denied the existence of this vulnerability, but this contradicts the official alerts from ZDI and CSIRT Italy, and industry experts have expressed strong doubts about Telegram's claims.
| Item | Status |
|---|---|
| Telegram Notification | March 26, 2026 |
| Telegram Official Patch | Not Released |
| ZDI Disclosure Scheduled | July 24, 2026 (Full technical details disclosed if patch incomplete) |
| CSIRT Italy Alert | Issued (Official analysis and mitigation guide provided) |
| Telegram Official Position | Denies existence of vulnerability (Industry experts refuting) |