Key Takeaways
- Researcher Saifeldeen Aziz claims he chained Telegram sticker vulnerabilities to execute code on iOS without user interaction.
- He alleges that bypasses defeat Telegram’s validation checks while vulnerable rendering code remains in official apps.
- A separate October ZDI advisory documents a remote flaw requiring user interaction, distinct from Aziz’s zero-click claims.
Security researcher Saifeldeen Aziz says he discovered multiple zero-click vulnerabilities in Telegram’s animated stickers and combined them to execute code on iOS, challenging the messaging platform’s reliance on server-side security checks.
His research, outlined in an OffensiveCon presentation abstract, describes bypasses for protections that Telegram previously argued prevented malicious stickers from reaching vulnerable applications.
Aziz alleges that flawed rendering code remains deployed across official clients.
The claims raise fresh questions about Telegram’s handling of sticker vulnerabilities, although the abstract leaves important details about affected versions, exploitation requirements and remediation unresolved.
Researcher Claims Sticker Checks Can Be Bypassed
Aziz’s yearlong investigation focused on rlottie, the animation-rendering library used for Telegram’s animated stickers.
According to his abstract, testing uncovered multiple memory-corruption vulnerabilities affecting Telegram clients on iOS, Android, and desktop computers. He used large language models to help orchestrate fuzzing, a technique that feeds malformed inputs to software to identify unexpected behavior.
The researcher then identified separate logic flaws in Telegram’s sticker delivery and validation processes. Combining those weaknesses allegedly allowed him to bypass safeguards and reach vulnerable rendering code.
Aziz says he ultimately chained the vulnerabilities to achieve code execution against Telegram for iOS. However, his abstract also explicitly acknowledges limitations to the resulting exploit.
A zero-click attack requires no deliberate action from its target. That makes automatically processed content a particularly sensitive security concern.
Telegram’s developer documentation explains that animated stickers use the .tgs format, which contains compressed JSON animation data that rlottie can render.
The application therefore processes structured animation instructions rather than simply displaying a static picture.
The published abstract does not establish that the claimed iOS code execution provides unrestricted access to an entire iPhone or defeats Apple’s operating-system protections.
October Advisory Adds Context to March Dispute
The allegations follow a separate vulnerability report from Trend Micro’s Zero Day Initiative, credited to researcher Michael DePlante.
ZDI published that advisory on Oct. 15, identifying the issue as CVE-2026-111105, with a severity score of 7.0. It describes a numeric truncation vulnerability in rlottie that can cause software to write before the beginning of an allocated memory buffer.
According to ZDI, an attacker could exploit the flaw to execute code within the affected process. Crucially, the published advisory says exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.
Readers should therefore distinguish the documented vulnerability from Aziz’s newly claimed zero-click chains.
The disclosure timeline records Telegram’s Mar. 31 position that server-side validation mitigated the vulnerability.
Telegram subsequently requested a complete remote-code-execution chain. ZDI rejected that requirement as inconsistent with established coordinated disclosure practices and later notified Telegram of its intent to publish a zero-day advisory.
The October advisory lists no fixed version and recommends restricting interaction with the product.
Previous Sticker Flaws Highlight a Recurring Challenge
Telegram’s animated sticker code has attracted security scrutiny before.
In a 2021 study, cybersecurity firm Shielder documented 13 vulnerabilities discovered during a 2020 investigation of Telegram’s animation-processing attack surface. Those included memory corruption, type confusion, and denial-of-service issues.
Shielder said Telegram fixed those specific vulnerabilities through Android, iOS, and macOS updates released in September and October 2020. Those historical fixes do not establish the status of Aziz’s current findings.
The central question now concerns whether Telegram’s server checks adequately compensate for vulnerable client code.
Aziz argues that bypassable filtering leaves a dangerous dependency on the provider’s infrastructure. His abstract even raises the possibility of describing that architecture as something resembling a backdoor.
That characterization remains his argument. The published material does not demonstrate an intentionally planted backdoor, an active hacking campaign or widespread compromise of Telegram users.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
