Telegram, a messaging app known for its crypto-friendly stance, has refuted claims suggesting that a vulnerability on its platform exposed users to potential attacks.

The alleged vulnerability

Blockchain security company CertiK claimed on April 9 that Telegram's desktop application had a potentially high-risk Remote Code Execution (RCE) vulnerability. The firm reported:

"A possible RCE was detected in Telegram's media processing within the Telegram Desktop application. This vulnerability exposes users to potential attacks through specially crafted media files, such as images or videos."

According to CertiK, this vulnerability could enable malicious actors to send RCE to users, potentially putting them at risk of attacks via specially crafted media files.

The security firm clarified that the vulnerability is limited to desktop apps capable of executing programs contained within files. Mobile applications are unaffected as they do not execute programs.

CertiK recommended users to disable the auto-download feature on the desktop application for enhanced security. Users can adjust their media download settings to manual downloads within the app's settings.

Telegram's response

In a post on X (formerly Twitter) on April 9, Telegram suggested that the trending videos were likely a hoax, stating that there was no such vulnerability on its platform.

However, the platform encouraged users to report any threats or potential vulnerabilities in its applications via its bug bounty program.

Meanwhile, a CertiK spokesperson informed CryptoSlate that the firm had not been in contact with Telegram and that news of the vulnerability had originated from the security community. The spokesperson added that the mobile version of the messaging app was secure from this vulnerability because it "does not directly execute executable programs like desktops, which generally require signatures."

CertiK reiterated that its social media post about the vulnerability aimed to raise awareness of the potential issue and remind users of best practices.