@thezdi I'm really frustrated with the way ZDI lists this without any information. 9.8 means nothing anymore, and when all we have is that the vendor is "Telegram" we have no idea if that means:
- RCE
- Broad-stroke mitigations if so (being broader to prevent ID)
- A flaw with their blockchain crap
- A flaw in their payment platform
- A vulnerability in the bot API allowing malicious takeover of a bot

I know details need to be sparse but the way this is listed feels attention-seeking for ZDI more than to help allay fears in users that are now panicking and coming up with supposed mitigations.

@thezdi

it reduced to 7.0 in the mean time

and here in the update section is some explanation

https://securityonline.info/telegram-critical-zero-click-vulnerability-zdi-can-30207/