Telegram CVE-2026-111105

Exploitation requires the victim to open or render a malicious Lottie animation processed by Telegram's bundled rlottie library - the flaw is in rlottie's handling of user-supplied animation data, so the specific trigger is parsing an attacker-crafted Lottie/TGS sticker or animation. Limiting factors: user interaction is mandatory (UI:R - the target must visit a malicious page or open a malicious file, so there is no zero-click or server-side path indicated), attack complexity is high (AC:H - reliably converting the pre-buffer out-of-bounds write into code execution requires defeating memory protections), and the CVSS vector scores this as local (AV:L), consistent with a client-side file/content-handling bug rather than an unauthenticated network service. No special configuration is noted; rlottie animation rendering is a default feature of the Telegram client.

This is a moderate-priority issue rather than a drop-everything emergency, and the signals are largely consistent once read carefully. The CVSS 3.0 base score is 7.0 (High) with vector AV:L/AC:H/PR:N/UI:R, meaning no privileges are required (PR:N, unauthenticated) but exploitation demands user interaction (UI:R), carries high attack complexity (AC:H), and - notably - is scored as a LOCAL attack vector (AV:L) despite the description's phrase 'remote attackers.' This is a real tension to flag: ZDI models file-parsing/open-a-malicious-file bugs as AV:L even when the file is delivered over the internet, so the practical delivery is remote but the technical trigger is local file/content handling - verify intended delivery path before treating this as a drive-by network exploit. Impact is uniformly high (C:H/I:H/A:H) because an out-of-bounds write (CWE-197 numeric truncation leading to a write before the start of an allocated buffer) yields arbitrary code execution in the process context. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H and UI:R requirements further argue against trivial mass exploitation. The core mitigating factors (user must open a malicious file/page, high complexity to weaponize a memory-corruption primitive) temper the otherwise severe RCE impact, making this a patch-on-normal-cycle issue absent new exploitation signals.

An attacker crafts a malicious Lottie animation that triggers a numeric truncation in Telegram's rlottie parsing library, causing a write before the start of an allocated buffer. The victim receives and opens the animation (or visits a page that renders it), and the resulting memory corruption lets the attacker execute arbitrary code in the context of the Telegram process. No public exploit code is identified at time of analysis, and high attack complexity (AC:H) means reliable exploitation requires non-trivial memory-corruption engineering.