stackbit.me

🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process. Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level. ⠀ The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer. ⠀ Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur. ⠀ Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15. ⠀ No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed. Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.