ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram

ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram(zerodayinitiative.com)

10 points by km 98 days ago | 3 comments

terom 95 days ago |

https://x.com/telegram/status/2038069726316834994 Telegram claims that exploitation of the vulnerability is blocked by server-side validation of stickers

g-b-r 97 days ago |

Despite the name of the website this is in all likelihood not a zero-day: they say it was discovered by an employee of the Zero Day Initiative, so it should have only only been reported to Telegram, and besides them only TrendAI (TrendMicro) should know anything about it

km 94 days ago |

And in the meantime, CVSS went down to 7.0.

I wonder why Trend publishes such upcoming advisories -- are those even helpful? For sure, I am going to be more critical of anything that ends up there.