CVE-2026-111105
Telegram rlottie numeric truncation can run code from a crafted animation
A crafted animation file or page can make Telegram's rlottie library write before a buffer and run code in the app. CVSS 7.0. No fixed version confirmed. Not in CISA KEV; no known attacks.
By ThreatWire Desk · Published 15 Oct 2026 · Updated 28 Oct 2026
- CVSS
- 7
- Vector
- CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Class
- RCE
- Status
- No PoC
- KEV
- Not in CISA KEV
- 0-day
- No
- Vendor
- Telegram
- Products
- Telegram (rlottie animation library)
- Affected
- Telegram 6.6.2, the only version in the CVE record. The record does not name a platform, and the status of other versions is unknown.
- Fixed
- None announced. ZDI published the advisory without a fix. Telegram Desktop and Telegram for Android have since replaced rlottie in their public source, but no source ties that change to this CVE.
- CWE
- CWE-197
- Published
- 15 Oct 2026
- Updated
- 28 Oct 2026
No public PoC is confirmed on this record.
What happened
A crafted animation file or web page can run code inside the Telegram app. The bug sits in rlottie, the library Telegram uses to draw animated stickers.
Bad animation data can make the library write before the start of a memory buffer. ZDI classes it as a numeric truncation error (CWE-197).
ZDI scores it CVSS 7.0 (High). It published advisory ZDI-26-757 on 15 October 2026 as a zero-day advisory, meaning no fix was available.
Who is affected
ZDI names the product only as Telegram. The CVE record lists version 6.6.2 as affected and gives no platform.
The status of every other version is unknown. Telegram Desktop 6.6.2 came out on 3 March 2026, but the record does not say it means the desktop app.
The target must open a malicious file or visit a malicious page. ZDI's final advisory does not describe a zero-click attack.
What is confirmed
ZDI reported the bug to Telegram on 26 March 2026. On 31 March, Telegram replied that server-side validation of stickers mitigated it.
On 14 April, Telegram asked for a complete code execution chain. ZDI declined, saying that demand does not match coordinated disclosure practice.
NVD lists the record as Awaiting Analysis, with no NVD score. GitHub carries it as unreviewed advisory GHSA-6r3v-wp87-h2gv.
The CVE is not in the CISA KEV catalog (checked 28 October 2026). CISA's SSVC entry sets exploitation to none.
What is not confirmed
No fixed version has been announced. Telegram has published no security advisory for this bug.
Public source code shows a related change. Telegram Desktop replaced rlottie with a new renderer, tlottie, on 7 September 2026, in version 7.2.7.
Telegram for Android's public source also uses tlottie. Telegram for iOS still lists both libraries. Neither Telegram nor ZDI says this change fixes CVE-2026-111105.
We found no public proof of concept for this CVE and no reports of attacks.
What to do
- Update Telegram on every device to the latest version.
- Avoid opening animation files or links from people you do not know.
- Limit who can send you messages, in Privacy and Security settings.
- Watch this record for a fixed version from Telegram or ZDI.
Full context: Telegram rlottie bug can run code from a malicious file, ZDI warns.