Researcher Claims Telegram Can Be Hacked via Animated Stickers Without User Interaction
The exploit chain combined flaws in the rlottie library and sticker verification, but its functionality has not been independently confirmed.
Security researcher Sayf El Din Aziz reported a method to execute arbitrary code in Telegram for iOS through the processing of animated stickers. The description of his presentation at OffensiveCon Tokyo states that the attack requires no user action.
The research was based on the rlottie library, which is responsible for rendering vector animations. To identify vulnerabilities, Aziz used automated testing powered by large language models. This revealed several memory-handling issues affecting Telegram for iOS, Android, and desktop systems.
However, exploiting the library's flaws alone was insufficient to construct an attack. Telegram verifies stickers on its servers, limiting the delivery of malicious files to clients.
According to the researcher, he discovered additional logical errors in the sticker verification and delivery process. By combining these with the rlottie vulnerabilities, he constructed an exploit chain that executes code in the iOS client. This does not mean a similar chain has been demonstrated for all other platforms.
Separately, the Zero Day Initiative previously disclosed another vulnerability in this library—CVE-2026-111105. Its description explicitly states that opening a malicious file or page is required, so it cannot be conflated with the claimed zero-interaction attack.
The key question raised by Aziz’s research is the reliability of server-side filtering as the primary defense against vulnerabilities persisting in client code. According to the author, Telegram continues to rely predominantly on restricting access of dangerous data to the vulnerable handler.
