ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram
zerodayinitiative.com
ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram
1–4 of 4 posts
Re: ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram
#2Despite the name of the website this is in all likelihood not a zero-day: they say it was discovered by an employee of the Zero Day Initiative, so it should have only only been reported to Telegram, and besides them only TrendAI (TrendMicro) should know anything about it
Re: ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram
#3https://x.com/telegram/status/2038069726316834994 Telegram claims that exploitation of the vulnerability is blocked by server-side validation of stickers
Re: ZDI-CAN-30207: Unpatched 9.8 RCE zero-day in Telegram
#4And in the meantime, CVSS went down to 7.0.
I wonder why Trend publishes such upcoming advisories -- are those even helpful? For sure, I am going to be more critical of anything that ends up there.