Security researcher Saifeldeen Aziz has revealed a worrying set of findings about Telegram’s animated sticker handling: zero-click bugs in the sticker engine that he says can be chained to achieve code execution on iOS. His work — scheduled for presentation at OffensiveCon in Tokyo — follows a long-running exchange between researchers and Telegram about whether server-side checks are an adequate mitigation for client-side flaws.
How the flaw was characterized
ZDI (Trend Micro’s Zero Day Initiative) published advisory ZDI-26-757 on October 15, tracking a numeric truncation vulnerability in the rlottie library as CVE-2026-111105. According to that advisory, malformed input can cause a write before the start of a memory buffer, creating the conditions for potential code execution. Earlier reporting showed disagreement over severity: ZDI initially scored a related issue highly, but Telegram argued that server-side filters block exploit attempts, prompting ZDI to reduce the severity score from 9.8 to 7.0.
The disclosure dispute
Telegram pushed back publicly in March, calling an earlier report “fake” on the grounds that its servers vet stickers before clients ever run them. ZDI and others pushed back on that characterization, noting that weak client-side code still exists and that server-side checks are only as reliable as the server logic and cannot be audited by end users. The timeline includes requests from Telegram for a full exploit chain and ZDI’s insistence on normal disclosure practices; in July ZDI warned it would treat the issue as a zero-day if it remained unpatched.
What Aziz says he found
Aziz’s abstract describes a year of testing, starting with fuzzing rlottie — partly aided by large language models — which turned up several memory-corruption bugs across iOS, Android, and Desktop clients. He then says he identified logic flaws in how stickers are delivered and validated, and by chaining those client-side and delivery issues he made previously protected codepaths exploitable, culminating in code execution on Telegram for iOS. The public abstract does not include technical proof, patch status, or CVE numbers for the newly claimed bugs, so those specific claims should be treated as unconfirmed until his talk or a formal write-up appears.
Why rlottie and TGS stickers matter
Animated stickers in Telegram use the TGS format, a compressed Lottie animation that rlottie renders on-screen. Small crafted stickers can have outsize impact: a 269-byte sticker was shown to crash Telegram and lock a chat in prior analyses, and not every malformed sticker is caught by server filters. Rlottie has a history of issues — researchers previously reported multiple bugs in 2021 affecting Android, iOS, and macOS — and more recent Telegram-specific flaws (for example a Telegram Desktop flaw tracked as CVE-2026-107181 and the so-called EvilVideo bug on Android) underline that the client code has been a recurrent attack surface.
Practical advice for users and the broader question
Until Telegram updates the client-side code, practical steps remain the best immediate defenses: keep Telegram apps up to date, limit who can message or add you to groups, and avoid opening files or interacting with content from unknown contacts. ZDI also advises limiting interaction with the product while issues remain under investigation. Aziz’s closing question — if a provider’s servers are the only gate against zero-click bugs, is that a security fix, a design risk, or close to a backdoor? — is worth reflecting on: server-side mitigation can reduce exploitability but places trust in an opaque control that users cannot independently verify.
Licensed under CC BY-ND 4.0 International