(0Day) Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability
Vulnerability Details
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.
Additional Details
03/26/26 – ZDI reported the vulnerability to the vendor
03/27/26 – the vendor acknowledged the receipt of the report
03/31/26 – the vendor stated that the vulnerability was mitigated by server-side validation
04/07/26 – ZDI clarified the exploitability of the vulnerability
04/13/26 – ZDI asked for updates
04/14/26 – the vendor requested a complete RCE chain
04/14/26 – ZDI stated that requiring a full chain is inconsistent with industry standard coordinated disclosure practices and could affect active users
04/24/26 – ZDI asked whether the vulnerability would be fixed
07/30/26 – ZDI notified the vendor of the intention to publish the case as a 0-day advisory
-- Mitigation: Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product
Disclosure Timeline
- 2026-03-26 - Vulnerability reported to vendor
- 2026-10-15 - Coordinated public release of advisory
- 2026-10-15 - Advisory Updated
Credit
Michael DePlante (@izobashi) of TrendAI Zero Day Initiative
