A high-severity vulnerability, CVE-2026-111105 (CVSS 7.0 – High), has been identified in Telegram’s animated-sticker processing functionality. The flaw affects the rlottie library, which processes Lottie-based animated stickers, and stems from numeric truncation that can cause an out-of-bounds memory write. Successful exploitation may result in memory corruption and potentially code execution within the Telegram application. Separately, security researcher Saifeldeen Aziz reported discovering additional vulnerabilities that could be chained to achieve zero-click code execution on Telegram for iOS. However, the new exploit chain has not yet been assigned publicly disclosed CVE identifiers, and its technical details remain unconfirmed.
CVE-2026-111105 (CVSS 7.0 – High): Improper numeric handling in the rlottie animation-rendering library allows specially crafted animation data to trigger a write before the start of a memory buffer. This memory-corruption vulnerability may enable code execution when a vulnerable client processes malicious content. Telegram stated that server-side validation mitigates the issue, while the Zero Day Initiative (ZDI) maintains that the underlying client-side weakness remains. The vulnerability was publicly disclosed without a confirmed fix in the cited advisory.[/subscribe_to_unlock_form]
A high-severity vulnerability, CVE-2026-111105 (CVSS 7.0 – High), has been identified in Telegram’s animated-sticker processing functionality. The flaw affects the rlottie library, which processes Lottie-based animated stickers, and stems from numeric truncation that can cause an out-of-bounds memory write. Successful exploitation may result in memory corruption and potentially code execution within the Telegram application. Separately, security researcher Saifeldeen Aziz reported discovering additional vulnerabilities that could be chained to achieve zero-click code execution on Telegram for iOS. However, the new exploit chain has not yet been assigned publicly disclosed CVE identifiers, and its technical details remain unconfirmed.
CVE-2026-111105 (CVSS 7.0 – High): Improper numeric handling in the rlottie animation-rendering library allows specially crafted animation data to trigger a write before the start of a memory buffer. This memory-corruption vulnerability may enable code execution when a vulnerable client processes malicious content. Telegram stated that server-side validation mitigates the issue, while the Zero Day Initiative (ZDI) maintains that the underlying client-side weakness remains. The vulnerability was publicly disclosed without a confirmed fix in the cited advisory.[emaillocker id="1283"]
We recommend you to update Telegram Desktop to version 7.2.7, 7.2.9, or the latest available version depending on the issue you are addressing.
The following reports contain further technical details:
[/emaillocker]