Telegram rlottie bug can run code from a malicious file, ZDI warns

• Affected: Telegram, per ZDI. The CVE record names only version 6.6.2 and no platform. Other versions are unknown.
• Fixed in: No fixed version announced. Telegram Desktop and Android dropped rlottie in recent builds, but no source ties that to this CVE.
• Exploited? No known attacks. Not in CISA KEV (checked 28 October 2026).
• Do this now: update Telegram on every device. Do not open animation files or links from strangers.

What happened

A malicious animation file or web page can run code inside the Telegram app. The flaw is in rlottie, the library Telegram uses to draw animated stickers.

ZDI published advisory ZDI-26-757 on 15 October 2026, about 13 days ago. It tracks the bug as CVE-2026-111105 and scores it CVSS 7.0 (High).

ZDI labels it a zero-day advisory. That means it went public without a fix, not that attackers used it. Bad animation data can make the library write before the start of a memory buffer.

Who is affected

ZDI names the product only as Telegram. The CVE record lists version 6.6.2 as affected and does not say which platform.

Telegram Desktop 6.6.2 shipped on 3 March 2026, three weeks before ZDI's report. The record does not confirm that it means the desktop app.

The attack needs the user to act. The target must open a malicious file or visit a malicious page.

Earlier public descriptions of the case called it a zero-click sticker attack. ZDI's final advisory does not support that.

The table shows what each client's public source code contains today.

What is confirmed

ZDI reported the bug to Telegram on 26 March 2026. Telegram acknowledged it the next day.

On 31 March, Telegram said its server-side validation of stickers mitigated the bug. ZDI explained the exploitability again on 7 April.

On 14 April, Telegram asked ZDI for a complete code execution chain. ZDI declined, saying that demand breaks normal coordinated disclosure practice.

ZDI warned Telegram on 30 July that it would publish without a fix. Its only advice is to limit interaction with the app.

NVD lists the CVE as Awaiting Analysis, with no NVD score of its own. GitHub carries unreviewed advisory GHSA-6r3v-wp87-h2gv.

The CVE is not in the CISA KEV catalog (checked 28 October 2026). CISA's SSVC entry sets exploitation to none.

What is not confirmed

No fixed version has been announced. Telegram has published no security advisory, and ZDI links no patch.

Telegram Desktop's public code replaced rlottie with a new renderer, tlottie, on 7 September 2026. Version 7.2.7 shipped that day with a note on fixing crashes from invalid lottie files.

Telegram for Android's current source also uses tlottie. Neither Telegram nor ZDI says this change fixes CVE-2026-111105.

We found no public proof of concept for this CVE. A public sticker that crashes Telegram Desktop exists, but it causes a crash, not code execution, and does not cite this CVE.

A talk at OffensiveCon in Tokyo on 28 October 2026 claims new zero-click Telegram bugs. Its abstract has no CVE ids or technical detail, so we treat it as unconfirmed.

What to do

1. Update Telegram on every phone and computer to the latest version.
2. Avoid opening animation files, sticker files or links sent by people you do not know.
3. Limit who can message you, in Telegram's Privacy and Security settings.
4. Turn off automatic media download for chats with strangers, if you face targeted risk.
5. Watch our CVE-2026-111105 record for a fixed version.

Our take

This dispute is about who gets to call a bug fixed. Telegram says its servers block bad stickers. ZDI says the client code is still the weak point.

The quiet move to tlottie suggests Telegram took the rendering risk seriously. But without a statement, users cannot know which builds are safe.

It is not the only recent Telegram client report to pass through ZDI. See how one click could make Telegram Desktop leak local files.