In response to recent reports about automatic download security vulnerabilities, Telegram posted a message on the X platform: "We cannot confirm whether such a vulnerability exists. The video is likely a scam. Anyone can report potential vulnerabilities in our application and receive rewards."
Previously, the technology website Blue Dot Network posted a message on the X platform stating that the instant messaging tool Telegram has a high-risk security vulnerability. The attacker only needs to send specially crafted pictures, videos or files to the user to trigger the vulnerability without interaction. This vulnerability belongs to the category of 0day and 0click vulnerabilities, and the degree of harm is extremely high. It is recommended that users immediately turn off the automatic download function.
In response, Yu Xian, the founder of SlowMist, said that he could not be 100% sure whether it was a vulnerability or a 0day, and some sources of information were unclear, and there was suspicion of title party. He also said that many chat tools have similar mechanisms for automatic downloads. The key is whether the automatic download will automatically trigger malicious exploits.