[johnisgood]

There was (is) one though, audited by NCC Group in 2015. A vuln has been found but fixed by 2016. Not sure about other messengers.