🔎 Cybersecurity researcher Saifeldeen Aziz has announced a talk at OffensiveCon about the findings of his year-long research into the security of Telegram's animated stickers.
Using AI-assisted fuzz testing, he discovered several vulnerabilities in «rlottie», the library responsible for rendering animated stickers. These affected Telegram for iOS, Android, and Desktop.
The researcher also discovered logic flaws in Telegram's sticker delivery and server-side validation mechanisms. By chaining these vulnerabilities together, he was able to bypass Telegram's security protections and achieve zero-click code execution on iOS, without any user interaction.
However, Telegram had already started replacing «rlottie» with a new Rust-based library called «tlottie» back in late July 2026. It was first introduced on Android, followed by Unigram, then Telegram Desktop and macOS, and finally iOS in September.
The switch to Rust-based «tlottie» should reduce the risk of memory-safety vulnerabilities, but it does not rule out other security issues, including flaws in sticker delivery and server-side validation.
It is currently unknown whether the vulnerabilities discovered by the researcher still affect the latest versions of Telegram. The full technical details of the research have not yet been published, and the announced attack specifically targets the old «rlottie» library, which Telegram has already replaced in its clients.
@telelakel