It’s a mystery … alleged unpatched Telegram zero-day allows device takeover, but Telegram denies

A zero-day vulnerability (ZDI-CAN-30207, CVSS 9.8) disclosed by TrendAI/Zero Day Initiative was reported to allow zero-click remote code execution on Android and Linux Telegram clients via malicious animated stickers, potentially enabling full device takeover; ZDI withheld technical details to allow a fix. Telegram has denied the vulnerability, stating stickers are validated server-side and claiming code execution via stickers is technically impossible; the advisory notes no confirmed in-the-wild exploitation and suggests privacy settings mitigations for Business users.