Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhil

Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhile, the Messenger Replaced the Vulnerable Library

UPD 22:00 UTC. The researcher confirmed that Telegram has patched the flaw when migrated its clients to the tlottie library. Official clients users with latest updates installed are safe.

Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.

There is likely no direct threat to Telegram users on the latest versions of the official apps right now.

What exactly did the researchers find?

• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.

• Telegram relies on server-side verification to filter out malicious files.

• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.

• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.

Telegram replaced its sticker library

While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.

The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @tginfo editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.

Are these findings still relevant?

• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.

• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.

• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.

A systemic problem

The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.

Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.

In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @tginfo editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.

In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.

In the view of @tginfo editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @tginfo editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.

#vulnerabilities