ZDI-26-757: (0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
ZDI discloses a user-interaction Telegram rlottie RCE tracked as CVE-2026-111105.
The Zero Day Initiative published ZDI-26-757, a numeric truncation vulnerability in Telegram's rlottie component that could let a remote attacker execute arbitrary code. Exploitation requires the target to visit a malicious page or open a malicious file. ZDI assigned CVSS 7.0 and CVE-2026-111105. The advisory does not say the flaw is being exploited in the wild.
58