A security vulnerability in Telegram’s stickers has been uncovered, allowing unauthorized code execution on iOS devices. Security researcher Saifeldeen Aziz identified this zero-click flaw, which he planned to discuss on October 28 at OffensiveCon in Tokyo.
Telegram’s Server Checks Under Scrutiny
The discovery challenges Telegram’s previous assertions. In March, Trend Micro’s Zero Day Initiative (ZDI) reported a sticker-related bug, which Telegram dismissed as non-existent due to server-side checks. However, ZDI lowered the flaw’s severity score from 9.8 to 7.0 based on these claims. Despite Telegram’s stance, researcher Michael DePlante and Italy’s cyber agency highlighted the flaw’s persistence on client devices.
Details of the 0-Click Flaw
On October 15, ZDI issued advisory ZDI-26-757, identifying the bug tracked as CVE-2026-111105. The flaw, rooted in the rlottie library, involves numeric truncation, potentially leading to memory corruption and code execution. This advisory marks a culmination of a prolonged exchange, with Telegram initially asserting server-side mitigation on March 31. By mid-April, Telegram requested a comprehensive exploit chain from ZDI, which was deemed atypical by ZDI.
Research and Implications
Aziz spent a year scrutinizing Telegram’s rlottie library, using fuzzing techniques supported by large language models to uncover several memory-corruption issues across iOS, Android, and Desktop clients. He identified logic flaws in sticker delivery and validation, facilitating potential code abuse. Although the abstract lacks technical proofs or patch information, it underscores the need for verification in future discussions or publications.
Telegram’s rlottie library, used to display animated TGS-format stickers, has faced previous scrutiny. In 2021, Shielder reported similar vulnerabilities affecting various platforms. Additionally, recent issues like the CVE-2026-107181 vulnerability and the EvilVideo bug have spotlighted Telegram’s security challenges.
Recommendations and Future Outlook
Aziz’s findings raise critical questions about server-side defenses against zero-click vulnerabilities. Users are advised to maintain updated Telegram versions, limit message sources, and exercise caution with unsolicited files. As AI accelerates the pace of cyber threats, robust and responsive defenses are essential.
