VULNpocalypse
HighVulnerabilityActive

Telegram: unpatched rlottie sticker RCE (CVE-2026-111105) plus an Android voice-call flaw fixed in 12.10.4 without a CVE

An unpatched rlottie bug can run code in Telegram, and an Android voice-call flaw hit 8.6.2 to 12.10.3. Update Android to 12.10.4 and limit who can call.

Published
Updated
Fixed in
Telegram for Android 12.10.4 (voice-call flaw); no fix listed for CVE-2026-111105
Exploitation
No. Neither ZDI nor NebuSec reports use in attacks; CISA’s assessment on the CVE record says none

Live scores

CVE-2026-111105
EPSS
0.002
low predicted chance of attack
VEDAS
0.964
strong exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

Two separate Telegram issues became public in October 2026.

rlottie animated-sticker bug (CVE-2026-111105)

rlottie is the library Telegram has used to render animated stickers. On 15 October, the Zero Day Initiative published ZDI-26-757 as a zero-day, with no vendor fix. A numeric truncation in rlottie lets crafted data write before the start of a buffer, which can run code in the Telegram process. The target has to open a malicious file or page. ZDI scores it CVSS 3.0 7.0 (ZDI).

ZDI’s timeline (ZDI):

  • 26 March 2026: reported to Telegram.
  • 31 March: Telegram said server-side validation mitigated the issue.
  • 14 April: Telegram asked for a complete RCE chain. ZDI replied that this conflicts with standard coordinated disclosure.
  • 30 July: ZDI told Telegram it would publish as a zero-day.
  • 15 October: published.

Researcher Saifeldeen Aziz says Telegram’s server-side checks can be bypassed. At OffensiveCon in Tokyo he described chaining rlottie memory bugs with sticker delivery and validation flaws to run code on Telegram for iOS (The Hacker News).

Telegram has been replacing rlottie with tlottie, a Rust library. Android switched between 12.8.1 (June) and 12.10.0 (August). Desktop switched in September. iOS 13.0 (October) added tlottie but still includes rlottie (The Hacker News).

Telegram for Android voice-call flaw (no CVE)

On 29 October, NebuSec disclosed a flaw in how Telegram reads MediaState messages that apps exchange during calls. When a rotation value is present, the code reads the video-state field even if the message does not contain it, and reads memory it should not. NebuSec says it chained this with an information leak and an Android root exploit for full device control. The attacker needs only an ordinary Telegram account, and the victim has to answer (The Hacker News).

It affects Telegram for Android 8.6.2 to 12.10.3, released between March 2022 and September 2026. 12.10.4, released in late September, fixes it. NebuSec reported it on 26 September. Telegram acknowledged the report but did not believe it could lead to code execution, so no CVE was assigned. NebuSec confirmed it in private voice calls on ARM64 phones and has no evidence of impact on iOS, desktop or group calls. A fix in the shared tgcalls library (“Fix camera rotation”) landed on 21 April 2026 and reached iOS 12.7 and desktop 7.0.1 (The Hacker News).

No exploitation of either issue has been reported. CISA’s assessment on the CVE record lists exploitation of CVE-2026-111105 as “none” (CVE record).

Am I affected?

Android voice-call flaw: any Telegram for Android between 8.6.2 and 12.10.3. The version is shown at the bottom of the Settings page (The Hacker News). On managed or test devices:

bash
adb shell dumpsys package org.telegram.messenger | grep versionName

rlottie (CVE-2026-111105): ZDI lists no fixed version (ZDI). The CVE record lists only Telegram 6.6.2 as affected (CVE record), which says little about current builds. Based on The Hacker News’s account of the tlottie switch, Telegram for iOS is the client that still ships rlottie. Android from 12.10.0 and desktop builds from September onward have moved off it (The Hacker News).

Your own apps: rlottie is an open-source library used outside Telegram. Search your code and dependencies for it:

bash
grep -rli 'rlottie' --include='CMakeLists.txt' --include='*.gradle' --include='Podfile.lock' --include='*.pc' --include='meson.build' .

What to do now

  1. Update Telegram for Android to 12.10.4 or later on every device (The Hacker News).
  2. Set call privacy to Nobody where you cannot update yet: Settings, Privacy and Security, Calls. The Hacker News reports this blocks the attack, and the victim must answer for it to work (The Hacker News).
  3. For the rlottie bug, the only mitigation ZDI gives is to restrict interaction with the product (ZDI). For high-risk users on iOS, that means not opening stickers, files or links from unknown senders until Telegram ships a fix. Keep iOS Telegram on the latest version so it picks up the tlottie move.
  4. If your app renders Lottie files from untrusted sources with rlottie, treat it as unpatched. Render in a sandboxed process, accept only Lottie files you produced, or move to a maintained renderer.

Sources