Clientes Telegram para iOS · Public exploit code

ZDI publishes Telegram zero-day CVE-2026-111105 without client-side fix

Oct 28, 2026 · 1 min read

Trend Micro's Zero Day Initiative published CVE-2026-111105 (CVSS 7.0) on October 15, a flaw in Telegram's rlottie animation library that allows code execution within the app process through malicious animation data. ZDI's final advisory says exploitation requires user interaction; researcher Saifeldeen Aziz claims a 0-click chain with code execution on iOS, and Telegram told ZDI that server-side sticker validation mitigates the flaw. No patched versions or confirmed attacks have been disclosed; keep Telegram updated, disable media auto-download and avoid untrusted animated files, sticker packs and links.

By HIFY Radar newsroom Updated 10/28/2026 02:24 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityPublic exploit codePartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Trend Micro's Zero Day Initiative disclosed CVE-2026-111105 (CVSS 7.0), a flaw in Telegram's animated sticker library rlottie that allows code execution within the app process. Researcher Saifeldeen Aziz presented the flaw at OffensiveCon Japan and claims a 0-click attack; Telegram denies the risk and says server-side sticker validation mitigates it.

Why it matters

According to the researcher, the flaw affects Telegram clients for iOS, Android and Desktop, used by journalists, executives and government staff, and no patched version is confirmed. A malicious sticker could compromise a device and its conversations. ZDI lists no confirmed attacks in the wild.

What to do

Keep Telegram updated on every device. Disable media auto-download and animated stickers, restrict who can message users and tell staff not to open unknown animated files, sticker packs or links.

For the technical team

CVE: CVE-2026-111105
Affected: Clientes Telegram para iOS, Android e Desktop (biblioteca de renderização de stickers animados rlottie) · Telegram clients for iOS, Android and Desktop using the rlottie library. ZDI disclosed no affected versions. The researcher says rlottie was replaced by tlottie, written in Rust, removing the vulnerable code from clients.
Exploitation: No confirmed in-the-wild attacks per ZDI. The 0-click code execution claims on Telegram for iOS come from researcher Saifeldeen Aziz (OffensiveCon Japan talk) and are not independently verified. Published as a ZDI zero-day advisory on October 15 due to the lack of a client-code fix.
Fix: No patched versions disclosed. Telegram told ZDI that server-side sticker validation mitigates the flaw; the researcher says replacing rlottie with tlottie (Rust) removed the vulnerable code. Cited mitigations: keep apps updated, disable media auto-download and animated stickers, restrict who can message you, and avoid untrusted animated files, sticker packs and links.
Vector: rlottie animated sticker rendering library in Telegram clients for iOS, Android and Desktop. Improper validation of attacker-controlled animation data causes a write before the start of an allocated buffer, enabling arbitrary code execution within the app process. ZDI's final advisory requires user interaction (visiting a malicious page or opening a malicious file); the researcher claims a 0-click chain that bypasses server-side and client-side mitigations.
More details: Bugs found via LLM-orchestrated fuzzing of rlottie, per the researcher. Logic flaws in sticker delivery and validation were chained to bypass server-side and client-side mitigations. The flaw was reported to ZDI with an initial CVSS of 9.8, later lowered to 7.0. Telegram publicly denied the flaw exists, according to posts on X. Saifeldeen Aziz presented at OffensiveCon Japan in Tokyo (Oct 27-28).

Timeline

10/28/2026 02:24 PM
ZDI published the flaw as CVE-2026-111105 (CVSS 7.0) and says it remained unresolved at the client-code level.
10/28/2026 01:25 PM
Researcher shows the animated sticker runs code on the phone with no tap needed; Telegram denies the flaw exists, per post on X.
10/28/2026 01:22 PM
Researcher reports Telegram replaced the rlottie library with a Rust-based one (tlottie), removing the vulnerable code from the clients.

Want the next updates in your inbox? Get the daily edition →

See all 4 updates