Researchers Find Telegram iOS Sticker Vulnerability
The zero-click flaw allows remote code execution on iOS devices, a risk Telegram currently disputes.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust the security of messaging apps for handling your personal or financial data?
Security researchers have identified a zero-click remote code execution vulnerability within the Telegram sticker feature on iOS. This research-stage flaw allows attackers to execute code on a device without any user interaction.
Why it matters
The vulnerability demonstrates a critical security risk for mobile messaging, as zero-click exploits bypass standard user-verification protections. Telegram has disputed the severity of the findings, leaving the risk level for users contested.
The vulnerability operates through the Telegram sticker feature, triggering code execution on iOS hardware without requiring the recipient to click or open the content.
The players
Telegram
A cross-platform encrypted messaging service that maintains a significant global user base and disputed the researchers' severity assessment.
The details
The exploit functions by weaponizing the way the application processes sticker files, allowing for the unauthorized execution of code on the underlying iOS system. This constitutes a zero-click attack, meaning the payload triggers automatically upon receipt rather than requiring a user to click a link or interact with the interface. The researchers presented this mechanism at a security conference in Tokyo to highlight the potential for remote exploitation.
Timeline
October 2026: Researchers demonstrated the zero-click vulnerability.
The Tech Race
This finding follows a pattern of zero-click vulnerabilities identified in major global messaging platforms like Telegram. It highlights the continued arms race between security researchers testing platform integrity and the developers working to secure messaging architectures.
Users should be aware that this vulnerability currently has no confirmed software fix from the developer. Until an update is released, the flaw remains a potential vector for unauthorized code execution on iOS devices.
The takeaway
The lack of a confirmed software patch means Telegram users remain exposed to this identified vulnerability. Watch for official security updates from the platform to determine when or if this specific code execution vector is mitigated.
Further reading
For more updates on mobile application threats, see our coverage of Cybersecurity.
Live Poll
Do you trust the security of messaging apps for handling your personal or financial data?
