Telegram's rlottie Library Vulnerable to Remote Code Execution
A numeric truncation vulnerability in Telegram's rlottie library allows attackers to achieve remote code execution by tricking users into opening malicious files or visiting compromised web pages.
A critical vulnerability, identified as ZDI-26-757 by the Zero Day Initiative (ZDI), has been disclosed in Telegram's rlottie library, a component used for rendering Lottie animations. This flaw permits remote attackers to execute arbitrary code on affected installations of the messaging application.
The vulnerability stems from improper validation of user-supplied data within the rlottie library. Specifically, the issue involves a "write before start of an allocated buffer" condition, which occurs when the library fails to correctly handle numeric values. This oversight can be exploited by an attacker to overwrite memory outside of the intended buffer, leading to code execution within the context of the Telegram application process.
Exploitation of this vulnerability requires user interaction. Attackers can achieve this by luring a target user into visiting a malicious web page that serves specially crafted Lottie animations or by convincing them to open a malicious file containing such an animation. Once the malicious content is processed by the rlottie library, the attacker's code can be executed.
The disclosure timeline reveals a protracted engagement between ZDI and the vendor. ZDI initially reported the vulnerability on March 26, 2026. The vendor acknowledged the report but initially claimed the vulnerability was mitigated by server-side validation. ZDI clarified the exploitability, and after further exchanges regarding industry-standard disclosure practices and the vendor's request for a full RCE chain, ZDI announced its intention to publish the advisory as a 0-day on July 30, 2026, leading to the public release on October 15, 2026.
Given the nature of the vulnerability, which relies on user interaction with malicious content, the primary mitigation strategy recommended by ZDI is to restrict user interaction with the product. This could involve educating users about the risks of opening unknown files or visiting untrusted websites, as well as implementing stricter controls on how Telegram handles external content.
While the specific impact and prevalence of exploitation are not detailed in the advisory, the potential for remote code execution in a widely used application like Telegram is significant. Users are advised to ensure their Telegram clients are updated to the latest version once a patch is available, although the advisory notes the vendor's claim of server-side mitigation.
The vulnerability was discovered by Michael DePlante of TrendAI Zero Day Initiative. The advisory was publicly released on October 15, 2026, with an update on the same date. This disclosure highlights the ongoing challenges in securing complex software libraries and the importance of robust vulnerability management and coordinated disclosure processes.