It’s a Mystery … Alleged Unpatched Telegram Zero-Day Allows Device Takeover, but Telegram Denies

Key Takeaways

• Zero-click bug lets code run via malicious sticker.
• CVSS 9.8, affects Android and Linux Telegram clients.
• No patch available; vendor denies vulnerability existence.
• Researchers gave ZDI until July 24, 2026 to fix.
• Business users can restrict messages from unknown contacts.

Pulse Analysis

Zero‑click vulnerabilities have reshaped the threat landscape because they bypass the traditional human element of security hygiene. When a malicious payload can be delivered through an innocuous medium—such as an animated sticker—it eliminates the need for phishing clicks or app installations, dramatically increasing the attack surface. Telegram’s massive user base, estimated in the hundreds of millions, makes it an attractive vector for nation‑state actors and cyber‑crime groups seeking stealthy footholds on both personal and corporate devices.

Telegram’s outright denial of the flaw adds a layer of complexity for security teams. Without an official acknowledgment, vendors often delay issuing mitigations, leaving organizations to rely on unofficial workarounds or third‑party threat intel. The Zero Day Initiative’s deadline of July 24 2026 signals that the research community expects a patch, yet the lack of transparency can erode trust and complicate compliance efforts, especially for regulated sectors that must demonstrate proactive risk management. Industry observers are watching closely to see whether the company will eventually release a security advisory or if the dispute will persist, influencing broader discussions about responsible disclosure.

In the interim, enterprises can reduce exposure by tightening Telegram’s privacy settings, restricting inbound messages to known contacts, and monitoring for anomalous sticker traffic. The episode underscores the importance of layered defenses—endpoint protection, network segmentation, and user education—when dealing with platforms that process rich media automatically. As zero‑day exploits continue to command high prices on underground markets, the financial incentive for attackers remains strong, making timely patching and transparent communication essential for maintaining the integrity of critical communication tools.