Telegram animated stickers are drawn by a small rendering library, and a researcher says the bugs inside it can be chained into code execution on an iPhone without the owner touching anything.
Saifeldeen Aziz was scheduled to present at OffensiveCon in Tokyo on October 28. His summary says a year of fuzzing the rlottie library with help from large language models turned up several memory-corruption bugs across the iOS, Android and desktop clients, after which he found separate logic flaws in how Telegram delivers and verifies stickers.
What the vendor has said before
The argument is an old one. Trend Micro’s Zero Day Initiative reported a sticker bug through CVE-2026-111105, a numeric truncation in rlottie that can write before a buffer starts. Telegram replied that its servers inspect every sticker before a client plays it, and ZDI cut severity from 9.8 to 7.0 partly on that basis. The reporting researcher, Michael DePlante, maintained the parsing still ships on devices.
Advisory ZDI-26-757 landed on October 15. Messages sent between March and July show the wrangling: Telegram called the issue mitigated, asked for a full working chain in April, then heard a warning that the case would be published as a zero-day with no patch.
Why a server-side gate is the debate
Aziz’s summary says he bypassed Telegram’s checks. If that holds, the filter is a single point of trust rather than a repair, and users cannot audit what it screens. He asks whether that arrangement is mitigation, design risk or something close to a backdoor.
No patch status, no new CVE numbers and no technical evidence appear in the abstract, so treat the chain as unconfirmed until a write-up exists.
What iPhone owners can do
Keep Telegram current, tighten message and group invites, and avoid files from unknown senders.
