Researcher Uncovers New 0-click Flaw in Telegram Stickers and Chained Them to Run Code on iOS

Security researcher Saifeldeen Aziz says he found new zero-click bugs in Telegram stickers. He also says he chained them to run code on iOS. The work was due to be presented on October 28 at OffensiveCon in Tokyo, according to the conference agenda. Aziz says he got past Telegram’s server-side checks and that the flawed code still ships in its apps.

The talk is a direct challenge to a position Telegram took in March. Trend Micro’s Zero Day Initiative (ZDI) had reported a bug in the app’s sticker code. According to reports, Telegram called the flaw fake, saying its servers check every sticker before any app can play it. ZDI then cut the severity score from 9.8 to 7.0 because of those server-side checks.

The researcher behind that report, Michael DePlante, still said the weak code exists on the client side. Italy’s national cyber agency also took the report seriously.

0-click Flaw in Telegram Stickers

ZDI later released its advisory ZDI-26-757 on October 15. It tracks the bug as CVE-2026-111105 and describes a numeric truncation flaw in the rlottie library. Bad input there can cause a write before the start of a memory buffer, and that can lead to code execution.

The timeline shows a long back-and-forth. Telegram said on March 31 that server-side checks mitigated the bug. In mid-April, it asked ZDI for a full working exploit chain. ZDI called that request out of line with normal disclosure practice. In July, ZDI warned Telegram it would publish the case as a zero-day, which means a flaw with no patch yet.

Aziz’s abstract says he spent a year on Telegram. He began by fuzzing rlottie with help from large language models. Fuzzing means feeding a program huge amounts of broken input to make it fail. The abstract says this found several memory-corruption bugs in the iOS, Android, and Desktop clients.

He then found separate logic flaws in how Telegram delivers and checks stickers. By chaining them, he says he made the code that was supposed to be out of reach open to abuse. The final step was code execution on Telegram for iOS. He also plans to discuss the limits of that exploit. The public abstract gives no technical proof, no patch status, and no CVE numbers for the new bugs, so readers should treat the claims as unconfirmed until the full talk or a write-up appears.

Animated stickers use the TGS format, which is a compressed Lottie animation file. Telegram’s rlottie library draws them on your screen. Pasquale Pillitteri explained that one tiny 269-byte sticker could crash Telegram and lock a chat. He also noted that server filtering does not catch every case. Telegram Desktop 7.2.7 fixed that specific variant.

This is not the first time rlottie has been in trouble. A GitHub analysis recalls that Shielder found several rlottie bugs in 2021. Those affected Android, iOS, and macOS.

Telegram’s code has seen other trouble lately. Cyber Security News covered a Telegram Desktop flaw tracked as CVE-2026-107181, which could let a crafted link steal files and take over accounts before version 7.2.9. We also reported on the EvilVideo bug, where fake video files ran malicious code on Android.

Aziz ends his abstract with a hard question. If one provider’s servers act as the only gate against a zero-click bug, is that a fix, a design risk, or something close to a backdoor? The point is that users cannot check what the server does. They can only trust it.

Until Telegram changes the client code, the safest steps are simple. Keep every Telegram app fully updated, limit who can message or add you to groups, and avoid opening files from strangers. ZDI also advises limiting interaction with the product.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Researcher Uncovers New 0-click Flaw in Telegram Stickers and Chained Them to Run Code on iOS appeared first on Cyber Security News.