Researcher chains rlottie sticker bugs into zero-click Telegram exploit

At the OffensiveCon conference in Tokyo on October 28, security researcher Saifeldeen Aziz presented the findings of a year-long investigation into Telegram. Aziz demonstrated how memory corruption bugs in an animation library, combined with logic flaws in Telegram's backend validation, allowed arbitrary code execution on iOS devices without any user interaction.

The root of the issue lies in rlottie, an open-source library used by Telegram to render animated stickers stored in the proprietary TGS format. These files are essentially compressed JSON payloads detailing vector animations, which client applications decompress and draw locally. Using large language models to guide fuzzing against rlottie, Aziz uncovered several memory corruption flaws affecting client builds on iOS, Android, and desktop systems.

Client-side memory corruption does not automatically create an attack path if malicious files cannot reach the device. Telegram relies heavily on server-side pre-screening to sanitize and reject dangerous sticker payloads before delivery. However, Aziz identified logical oversights in how the servers inspect and route these files, allowing specially crafted assets to bypass both backend and client restrictions. Chaining these bypasses with rlottie's parsing flaws yielded a functional zero-click exploit chain on iOS.

The defense model has caused friction before. In March 2026, researcher Michael DePlante of the Zero Day Initiative reported an rlottie integer error (CVE-2026-111105) capable of out-of-bounds writes. ZDI initially gave it a CVSS score of 9.8, but reduced it to 7.0 after Telegram insisted its server checks neutralized direct delivery. Telegram subsequently requested a full working RCE exploit chain before patching the client, a demand ZDI rejected as contrary to standard responsible disclosure. ZDI published the advisory as a zero-day on October 15, though that specific report assumed user interaction.

Aziz contends that Telegram has continued to prioritize delivery filters over securing client-side parsing code. Currently, only the presentation summary is public; the complete technical mechanics, affected client versions, and independent reproductions remain unreleased.

Source: habr

Report: OffensiveCon, Advisory: Zero Day Initiative, Documentation: Telegram