An animated sticker is spreading through Telegram chats, causing the app to crash during rendering. The vulnerability affects iOS, Android, macOS, and Windows; the web version continues to function normally. The bug report had been in Telegram’s support system since July; developers only began fixing it in September, after the file became widely circulated. In short, Telegram has found its crush among the stickers.
How the crash works
Animated stickers in Telegram are TGS files: compressed gzip JSONs in Lottie format, where animations are described using vector contours defined by points. Clients render these files using a native animation engine — and it’s this engine that fails when encountering malicious content. Discussions around the bug suggest the issue lies in the number of points: the animation contains an abnormally high number of contour vertices, causing the client to crash while processing them. The web version uses a different Lottie renderer, which is why it remains stable among all official clients.
One additional detail: Telegram does perform server-side checks on uploaded stickers — some invalid files are rejected during upload — but the crash-inducing animation slips through. The client receives the file as a regular sticker and crashes during local rendering.
This explains the geographic scope of the crash: the app closes for anyone whose interface displays the animation — in a chat, in a conversation preview, or in the reactions list.
Timeline
The vulnerability has been known since July. Bug hunter @w1r3l355 submitted a report to Telegram support about a sticker that crashes all clients except the web version — without publicly sharing the file. The report was verified on Android, iPhone, Mac, and Windows: clients crashed across all four platforms, and the chat into which the sticker was sent became inaccessible to participants. No response or reward followed.
In early September, the file resurfaced — this time not reported, but shared widely across chats. On September 8, a second vector emerged: the sticker was converted into a custom emoji and set as a status here. Custom emojis use the same Lottie format, and statuses render next to a user’s name in every chat they appear in — meaning the crash no longer requires sending a message.
Fixing began after the file went viral. Meanwhile, the internet tallied the impact:
What to do before the fix
All effective workarounds boil down to one principle: prevent the client from rendering the animation.
- Battery saver mode in Telegram settings disables auto-play for animated stickers and emojis — the file isn’t parsed, so no crash occurs. This is the most reliable workaround.
- If the app crashes immediately upon launch — open any Telegram notification: the client starts from a specific chat, bypassing the failing one.
- Long-press the Telegram icon → “Favorites” or “Start a message” — launches the app outside the last opened chat.
- Web client works: use it to identify the sender, delete the message, and report the incident.
A summary of the workarounds was put together by users.
And a simple hygiene rule for the coming days: don’t set statuses or install sticker packs from random messages or “check if it works on you” links — until the fix arrives, any unfamiliar animation could be the malicious file. Verified packs remain available in the emoji and stickers catalogs.
The economics of the report
What stands out isn’t the vulnerability itself, but the path it took. The July report with a non-public proof-of-concept sat unanswered for over a month; the fix only started after the file went viral. For comparison: Telegram paid 100 dollars for a bug involving external links disguised as internal ones — a flaw that exposes user IP addresses. As of today, no reward has been issued for the animation that crashes all native clients.
