Researcher claims new zero-click Telegram sticker bugs can run code on iOS
Original title: Researcher Uncovers New 0-click Flaw in Telegram Stickers and Chained Them to Run Code on iOS
Aziz says logic flaws bypass server checks Telegram cited against rlottie bug CVE-2026-111105; no public proof or patch.
Saifeldeen Aziz says he found new zero-click flaws in Telegram stickers and chained them to execute code on Telegram for iOS, for an OffensiveCon talk on October 28. He says server-side sticker checks can be bypassed and the flawed client code still ships. Separately, ZDI advisory ZDI-26-757 tracks CVE-2026-111105, a numeric truncation bug in rlottie that can write before a buffer. The abstract gives no proof, CVE, or patch status for the new bugs.
Unconfirmed: Aziz's new bugs, exploit chain, and missing patch are unconfirmed; the abstract has no technical proof or CVE ids.
- ZDI cut an earlier sticker bug score from 9.8 to 7.0 after Telegram cited server checks.
- ZDI-26-757, published October 15, tracks numeric truncation flaw CVE-2026-111105 in rlottie.
- Telegram Desktop 7.2.7 fixed a separate crash from a 269-byte sticker.
- Aziz says LLM-assisted fuzzing found memory-corruption bugs on iOS, Android, and Desktop.
Impact: claimed code execution on Telegram for iOS
| Product | Affected |
|---|---|
| Telegram | — |
| rlottie | — |
- 1.Keep every Telegram app fully updated
- 2.Limit who can message you or add you to groups
- 3.Avoid opening files from strangers
- CVEs
- CVE-2026-111105
- Vendors
- Telegram
- Products
- rlottie
- Organizations
- Zero Day InitiativeTrend Micro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111105 | Numeric truncation RCE in Telegram rlottie | 7.0 | — |
From the original article
3 min read at cybersecuritynews.com
Security researcher Saifeldeen Aziz says he found new zero-click bugs in Telegram stickers. He also says he chained them to run code on iOS. The work was due to be presented on October 28 at OffensiveCon in Tokyo, according to the conference agenda.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.