devious.blue

What to know about the Telegram vulnerability?

Mar. 28 2026Mar. 30 2026 telegram ZDI-CAN-30207 ⚠️ This post is no longer up-to-date. As of March 30, ZDI has downgraded the severity of the vulnerability to 7.0. This reduced score suggests the vulnerability is not remotely-exploitable. A visual chart of the updated score's metrics is available here.

This sounds serious. Why aren't more details available?

This is how responsible disclosure works. If a security researcher finds a vulnerability, they will typically try to coordinate with the vendor to give them sufficient time to fix the problem and release an update. Further details at this point could provide valuable information to threat actors, who could then potentially discover the vulnerability and exploit it before an update is available.

Is this really a zero-click RCE?

This is not known for certain at this time. However, the vulnerability's Common Vulnerability Scoring System (CVSS) score given by the researcher suggests it may be the case. Even when concrete details about a vulnerability are not available, its CVSS score can give general information about its risk factors and impact. A visual chart of the score's metrics is available here.

Am I at immediate risk of being hacked?

Unless you're being targeted by nation-state threat actors, it is extremely unlikely you're at immediate risk. Here's why: Threat actors keep vulnerabilities like this close to their chest. RCEs in messaging platforms are rare and extremely valuable weapons (especially on a platform with over 1 billion monthly active users).

What should I do in the mean time? Should I turn off downloads?

You should look out for an update and patch as soon as it's available. At this time, it is not known whether the vulnerability has anything to do with automatic downloads. It is possible the vulnerability affects an entirely different feature, in which case turning off automatic downloads would be ineffective.