CVE-2026-111105
7.0HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-197
Impact
Attackers can execute arbitrary code within the Telegram process. They need a user to open a malicious file or visit a malicious page to trigger it.
Root cause
A numeric truncation issue in the rlottie library fails to validate input, resulting in an out-of-bounds write before the start of an allocated buffer.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.0 · CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Telegram and its bundled rlottie library once a vendor patch is released; until then, instruct users not to open untrusted files or media from unknown sources.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.