DoubleChecks

What was claimed

A security researcher found a new zero-click bug in Telegram stickers (rated 9.8/10 severity) that lets anyone hack your iPhone just by sending a sticker (no need to open it); Telegram denies it exists and claims their validation makes it impossible

Our verdict

Needs caution

The 9.8 CVSS score is reported for an earlier related Telegram vulnerability and was later reduced to 7.0. The newly described iOS exploit chain is not shown in the available sources as having a confirmed 9.8 rating. The available evidence supports demonstrated code execution in the Telegram iOS application, not unrestricted takeover of an iPhone. Reports also say the scope and exploit limitations are not yet established.

Combined assessment19 sourcesChecked Oct 29, 2026

Why this verdict

  • The vulnerability is rated 9.8/10 severity.

    Misleading
    All assessments reached this conclusion

  • It lets anyone hack your iPhone just by sending a sticker (no need to open it).

    Misleading
    Two assessments reached this conclusion; one differed·ChatGPT: Can’t verify

  • A security researcher found a new zero-click bug in Telegram stickers that can execute code on iOS without the recipient opening or interacting with the sticker.

    Verified
    All assessments reached this conclusion

  • Telegram denies that the vulnerability exists and says server-side validation makes the attack impossible.

    Verified
    All assessments reached this conclusion

Evidence reviewed

19 sources

Perplexity, Claude and ChatGPT sources are combined here.

cybersecuritynews.comsecuritylab.rutokenpost.comchaincatcher.comtokenpost.comoffensivecon.jppanews.iocyberinsider.comheise.deitsecuritynews.info

Individual assessments

Assessment summary

The core zero-click iOS code-execution claim is supported by a researcher’s conference abstract and several reports, but the available evidence does not establish that anyone can fully hack an iPhone merely by sending a sticker.cybersecuritynews.com securitylab.ru tokenpost.com The 9.8 severity rating appears to refer to an earlier related vulnerability that was later reduced to 7.0, while Telegram denies the claimed attack path and says server validation prevents malicious stickers.offensivecon.jp cyberinsider.com

Claims reviewed

The vulnerability is rated 9.8/10 severity.

Misleading
The 9.8 CVSS score is reported for an earlier related Telegram vulnerability and was later reduced to 7.0. The newly described iOS exploit chain is not shown in the available sources as having a confirmed 9.8 rating.offensivecon.jp cyberinsider.com

This claim may mislead readers without added context.

Anyone can hack an iPhone just by sending a sticker.

Misleading
The available evidence supports demonstrated code execution in the Telegram iOS application, not unrestricted takeover of an iPhone. Reports also say the scope and exploit limitations are not yet established.securitylab.ru tokenpost.com

This claim may mislead readers without added context.

A security researcher found a new zero-click bug in Telegram stickers that can execute code on iOS without the recipient opening or interacting with the sticker.

Verified
The researcher’s OffensiveCon abstract describes chained sticker-delivery and validation flaws achieving code execution in Telegram for iOS.offensivecon.jp Independent reports describe the demonstration as zero-click, though technical limitations remain unclear.securitylab.ru tokenpost.com

Assessment summary

  • The claim mixes accurate and misleading elements.
  • A zero-click sticker vulnerability with a 9.8 CVSS rating was indeed reported, and Telegram did deny it exists citing server-side validation.
  • However, the claim oversimplifies a complex, disputed situation: the vulnerability affects Android/Linux (not iPhone), the 9.8 score was later reduced to 7.0, and researchers have since demonstrated potential bypasses on iOS—making the current status contested rather than definitively proven or disproven.

Claims reviewed

Lets anyone hack your iPhone just by sending a sticker

Misleading
The original March 2026 vulnerability (ZDI-CAN-30207) affected Android and Linux, not iPhone cybersecuritynews.com darkreading.com. Recent October 2026 research by Aziz demonstrated code execution on iOS, but this is a separate, newer finding that researchers claim to have chained together x.com source unavailable. The claim conflates different vulnerabilities and platforms.

This claim may mislead readers without added context.

Rated 9.8/10 severity

Misleading
The initial CVSS score was 9.8, but ZDI officially reduced it to 7.0 in their published advisory (ZDI-26-757) on October 15, 2026, citing server-side mitigations cybersecuritynews.com darkreading.com. The 9.8 rating is outdated and no longer the official severity score.

This claim may mislead readers without added context.

A security researcher found a new zero-click bug in Telegram stickers

Verified
Multiple researchers have reported zero-click vulnerabilities in Telegram stickers. Michael DePlante of Trend Micro ZDI reported ZDI-CAN-30207 in March 2026, and Saifeldeen Aziz presented findings at OffensiveCon Tokyo in October 2026 cybersecuritynews.com x.com.

Assessment summary

  • The statement mixes accurate reporting of a disclosed high-severity Telegram sticker vulnerability with inaccurate or unverified specifics about iPhone takeover and absolute zero-click impact.
  • Public advisories and press reports show a ZDI entry (ZDI-CAN-30207) initially scored 9.8 and linked to sticker rendering, but later details, vendor responses, and score revisions cast doubt on the claim that any iPhone can be hacked merely by receiving a sticker.
  • Telegram publicly disputed the sticker attack vector and said server-side validation mitigates the issue.

Claims reviewed

The bug was rated 9.8/10 severity.

Misleading
An initial advisory and reports referenced a CVSS 9.8 rating, but later write-ups and researcher notes indicate the score was reduced (to ~7.0) after reassessment. redhotcyber.com offensivecon.jp

This claim may mislead readers without added context.

It lets anyone hack your iPhone just by sending a sticker (no need to open it).

Can’t verify
Press coverage claimed zero-click potential, but vendor statements and later advisories dispute or narrow the impact and platform scope, so a universal "hack any iPhone just by sending a sticker" claim is not confirmed. cybernews.com t.me

Telegram denies it exists and claims their validation makes it impossible.

Verified
Telegram publicly disputed the sticker-based exploit scenario and stated server-side sticker validation prevents such exploits. t.me redhotcyber.com

Check your own claim

Paste any statement, headline, or AI answer. Independent assessments check it and compare sources.

Share this result