-
A flaw in Telegram’s rlottie animation library could let attackers run code inside the app.
-
Trend Micro’s Zero Day Initiative gave the flaw a high severity score of 7.0.
-
The advisory says users must take an action first, and it names no confirmed app fix.
Security researchers have warned about a new flaw in Telegram. It sits in rlottie, the animation library the messaging app uses. Attackers could use it to run their own code inside the Telegram process on a device.
Researchers track the flaw as CVE-2026-111105. It scored 7.0 on the CVSS scale, which places it in the high severity group. Trend Micro’s Zero Day Initiative (ZDI) shared the details in an official advisory on October 15, 2026.
Telegram Animation Library Carries a High Severity Bug
ZDI describes the bug as a numeric truncation problem. In simple terms, the library cuts a number short while it handles animation data. That mistake leads to an out of bounds memory write. The library then writes data outside the space set aside for it.
According to the advisory, the library does not check user-supplied animation data well enough. A specially made input can push data in front of the start of a memory buffer. A buffer is a block of space the software reserves for data. This kind of memory damage can give an attacker a chance to run code.
The damage could also reach beyond the code itself. A public record of the flaw shows the issue could affect the app’s confidentiality, integrity, and availability. Those three words mean keeping data private, keeping it unchanged, and keeping the app usable.
Some descriptions have called the issue a zero-click attack that works through animated stickers. The advisory says something different. According to ZDI, a user must take action first. The victim must visit a harmful page or open a harmful file. The published technical details do not show that simply receiving a sticker or message sets off the attack.
ZDI and Telegram Clash Over Months of Disclosure Talks
ZDI first reported the flaw to Telegram on March 26, 2026. Telegram confirmed the report the next day. On March 31, the company said checks on its servers already reduced the risk.
Talks continued for several more months. ZDI asked Telegram for more updates and clarity. On April 14, Telegram asked ZDI for a complete remote code execution chain. That means a full set of steps showing the attack from start to finish. ZDI refused that request. The group said the demand did not match its coordinated disclosure practices. It also said the wait could leave active users exposed.
On July 30, ZDI told Telegram it planned to publish the case as a zero-day advisory. The flaw became public on October 15 under advisory number ZDI-26-757. A separate bug tracking entry also lists the same CVE number.
The dispute shows an important difference between two kinds of safety. A server can reject harmful content before it reaches a user. That does not prove the app handles the same content safely once it arrives. Server checks may lower the risk, but they do not make every path inside the app safe.
In a separate effort to combat cybercrime, Japan’s GMO has offered $1 million for tips leading to the arrest of cyberattack suspects.
Fix Status Stays Unclear as Users Face the Risk
ZDI’s guidance tells users to limit how they interact with the product. The advisory does not name a confirmed fix for the Telegram app itself. It also gives no list of every affected version.
The public CVE record names Telegram version 6.6.2 as affected. That record does not show the status of every other version. It also does not point to a confirmed fixed release. A technical summary of the flaw adds no proof of real attacks either. Public information does not confirm that attackers have used the flaw in the wild.
Telegram users should install the newest app updates. They should stay alert to odd files, links, and animated content from people they do not trust. Users should avoid opening attachments they did not expect. They should also skip unfamiliar pages that arrive through messages.
These steps can lower the risk. They cannot promise full protection from the flaw itself. Users should watch for a security update from Telegram. A clear note from the company that covers the affected code would also help.
Security teams and administrators have a job to do as well. They should keep checking the ZDI advisory and the official vulnerability records. Those pages may show new details about affected versions and fixes.
As of October 29, 2026, the main concern is the chance of code execution. No evidence shows wide attacks so far. Until Telegram clearly documents a fix, users should treat unexpected files and links with care. People should also avoid calling the flaw a confirmed zero-click attack.
