Security researcher Saifeldeen Aziz has discovered new zero-click vulnerabilities in Telegram’s sticker system, capable of chaining together flaws to execute code on iOS devices. His findings, set to be revealed October 28 at OffensiveCon in Tokyo, challenge Telegram’s recent claim that its server-side checks make certain sticker bugs harmless. Aziz reports that dangerous sticker-related code remains active in Telegram’s apps.
What’s the flaw?
The issue, tracked as CVE-2026-111105, involves a numeric truncation bug in Telegram’s rlottie library. Malformed inputs can trigger a “write before start of buffer” condition—essentially corrupting memory and potentially enabling remote code execution. While Telegram insists its servers screen each sticker before delivery, Aziz says client-side weaknesses escape those defenses and remain exploitable.
Aziz’s exploration began with fuzzing the rlottie library—feeding it malformed data, some of which was generated with large language model assistance. That work uncovered multiple memory corruption bugs across Telegram’s iOS, Android, and Desktop versions. On iOS in particular, he says he built an exploit chain that bypasses Telegram’s logic and server checks to run code within the app.
Timeline & Telegram’s response
The zero-click flaw has roots in earlier vulnerability reports. In March, the Zero Day Initiative (ZDI) flagged bugs in Telegram’s sticker handling. Telegram disputed the severity, claiming server-side checkers would prevent any malformed sticker from reaching the client. ZDI initially rated the issue 9.8/10, but downgraded it to 7.0 after Telegram’s assurance of mitigation through server checks.
Despite Telegram’s claims, Aziz says mechanisms meant to safeguard users are insufficient. He further notes that until deemed fixed, client-side logic flaws remain present. No patch has yet been confirmed public, and some variant sticker issues have only been partially addressed (for example, a specific format causing crashes fixed in Telegram Desktop 7.2.7).
Aziz also raises a broader question: is relying on server-side checks alone enough to protect users? If only providers can verify content before release, users must trust those checks implicitly—which may leave freedom for abuse.
What users should do now
Until Telegram fully remedies the uncovered vulnerabilities, users are advised to keep all Telegram apps updated, restrict who can message or add them to groups, and avoid opening stickers or files from unknown sources. ZDI adds that limiting interaction with Telegram from untrusted parties is among the safest strategies.
This isn’t the first time rlottie has caused trouble. Previous bug findings have revealed similar memory issues in rlottie across platforms including Android, iOS, and macOS. Telegram has been grappling with related exploits lately—one allowing malicious links to steal files, another letting fake video files execute arbitrary code.
Importantly, Aziz’s talk hasn’t released full technical proof of exploit details, and the newly claimed bugs are unconfirmed until his public presentation or a write-up is made available.
Now more than ever, this discovery highlights the need for stronger client-side defenses in popular apps like Telegram. It underscores that server validations can’t be the sole safeguard. As users, the best protection is vigilance—updating apps, managing permissions and trust, and carefully vetting incoming content. For the industry, the lesson is clear: trust models can no longer lean entirely on remote controls—secure clients are essential.
