On October 28, at the OffensiveCon conference in Tokyo, researcher Saifeldeen Aziz delivered a talk on zero-click vulnerabilities in Telegram animated stickers. These vulnerabilities require no user interaction; it's enough for the client to render the received sticker. According to the abstract, several memory-corruption bugs were found in the rlottie library, which Telegram clients use to render these stickers. Server-side sticker validation was bypassed through logical flaws in their delivery. For Telegram on iOS, the chain, according to the author, leads to code execution. This primarily affects iPhone and iPad owners: on Android and desktop, stickers are already rendered by a new Telegram engine, while rlottie is still present on iOS.

What is Known About the Talk

The talk is titled "Stickers r-lot-tie Handle: Vulns, Bypasses, and Telegram's Zero-Click Attack Surface" and was listed in the program for the second day of the conference, October 28, at 10:30 AM Tokyo time. The organizers published a photo from the stage at 01:32 UTC, during the presentation. There are no recordings, slides, public analysis, or CVE numbers for Aziz's findings yet, so all that is known about the content is from the abstract.

According to the abstract, the research took about a year and consists of three steps:

  • rlottie Fuzzing. Fuzzing is the automated feeding of millions of malformed files to a program in search of crashes; here, it was conducted by a language model. It found several memory-corruption bugs that, according to the abstract, affect Telegram clients on iOS, Android, and desktop.
  • Server-Side Validation Bypass. The Telegram server validates stickers and blocks suspicious files—this was the basis of the threat model. The abstract describes specific logical flaws in how stickers are delivered and validated, along with several bypasses for server-side and client-side protections.
  • Chain Against iOS. All these components are combined into an exploit that executes code in Telegram for iOS; the author separately discusses the exploit's limitations.

The abstract does not include reproduction steps, and this article does not provide them either.

Why a Sticker is Dangerous Without a Click

An animated sticker is a TGS file: a gzip-compressed JSON in Lottie format, where the animation is described by vector contours. The client rasterizes it using a native library as soon as the sticker enters the visible area: in a chat, in a dialog preview, in reactions, or in custom status emojis. Therefore, a bug in the renderer presents a zero-click attack surface, and the only filter between the sender and the vulnerable code is the Telegram server.

This leads to the question that concludes the abstract: if client security relies on the provider deciding which file reaches the vulnerable code, then what is it—a security measure, an architectural risk, or something closer to a backdoor?

The ZDI Case

The talk continues a debate that began in the spring. On March 26, Zero Day Initiative informed Telegram about a bug in rlottie that allows writing data before the start of an allocated buffer and executing code. On March 31, Telegram replied that the vulnerability was closed by server-side validation, and on April 14, it requested a full code execution chain. On October 15, ZDI published bulletin ZDI-26-757 as an unpatched vulnerability, with a CVSS score of 7.0; in the spring, when the case was first reported, a score of 9.8 was mentioned (SecurityAffairs, CyberInsider). Aziz's talk is structured as a refutation of Telegram's argument: the code, which was considered unreachable, turned out to be reachable.

rlottie itself is not a new target for Telegram. In 2020, Shielder found 13 bugs in it, including CVE-2021-31322; these were fixed in version 7.1 in autumn 2020, and an analysis was published in February 2021. In September 2026, a sticker that crashed the application on all clients except the web version circulated in chats.

What Telegram is Changing in the Code

Telegram is writing its own Lottie renderer in Rust—tlottie. Its description explicitly states that animation JSON is considered untrusted input, and it is compared to a 2019 rlottie fork used by clients.

In the source code of Telegram for Android 13.1.1, the native rlottie is no longer present—a compiled tlottie is there; Android switched to it by version 12.10.0, and desktop in September.

In Telegram for iOS, tlottie was added on September 11—as a second engine alongside rlottie, not replacing it. Stickers, emojis, reactions, and the sticker keyboard choose the engine for each rendering, and the server can revert them to rlottie with the ios_killswitch_disable_tlottie flag. In 50 other places—secondary interfaces, pre-login screens, the "Share" window, media editor export—rlottie always renders. Whether these changes are related to Aziz's findings is not apparent from the code; the abstract states that the vulnerable rendering code remains in official clients.