A talk scheduled for October 28, 2026 at OffensiveCon in Tokyo reopens a disagreement that has simmered between Telegram and vulnerability researchers for most of the year. Security researcher Saifeldeen Aziz says he discovered new zero-click vulnerabilities in how Telegram renders animated stickers, and that he successfully chained them into working remote code execution on the iOS app — bypassing server-side filtering that Telegram has repeatedly pointed to as a sufficient safeguard.

A Bug Telegram Called Fake

The backstory starts in March, when Trend Micro’s Zero Day Initiative (ZDI) reported a bug in Telegram’s sticker-handling code. Telegram’s response was that the flaw wasn’t exploitable in practice, because every sticker is checked by its servers before any client app is allowed to play it. ZDI subsequently lowered the bug’s severity score from 9.8 down to 7.0 to reflect that mitigation — but the researcher who filed the original report, Michael DePlante, maintained that the underlying flawed code was still present on the client side, where server checks can’t always reach it. Italy’s national cybersecurity agency reportedly treated the report seriously despite Telegram’s pushback.

ZDI eventually published its advisory, tracked as ZDI-26-757 and assigned CVE-2026-111105, on October 15. It describes a numeric truncation bug in rlottie, the open-source library Telegram uses to render animated TGS stickers, which can cause a write before the start of a memory buffer — a classic setup for memory corruption and, potentially, code execution.

A Contentious Disclosure Timeline

The back-and-forth between Telegram and ZDI stretched across several months. After dismissing the bug in March, Telegram asked ZDI in mid-April for a complete, working exploit chain — a request ZDI characterized as inconsistent with normal coordinated-disclosure practice. By July, ZDI warned it intended to publish the issue as an unpatched zero-day. That dispute set the stage for Aziz’s research, which picks up the question Telegram’s server-side defense was supposed to have settled.

A Year of Fuzzing Leads to a Full Exploit Chain

According to his conference abstract, Aziz spent roughly a year targeting rlottie, using fuzzing — a technique that bombards a program with malformed input to trigger crashes — with assistance from large language models to speed up the process. That effort reportedly surfaced several distinct memory-corruption bugs across Telegram’s iOS, Android, and desktop clients. Aziz says he then identified separate logic flaws in how Telegram delivers and validates stickers, and that combining the two categories of bugs let him defeat the server-side filtering Telegram has cited as its primary defense. The abstract states the final result was working code execution against Telegram for iOS specifically, alongside a discussion of the exploit’s practical limitations. Notably, the public abstract released ahead of the talk offers no proof-of-concept code, no confirmed patch status, and no formal CVE numbers for these newer bugs, so the specifics should be treated as unconfirmed claims until a full technical write-up is published.

Not rlottie’s First Rodeo

This isn’t the first time Telegram’s animated-sticker pipeline has drawn scrutiny. Researcher Pasquale Pillitteri previously showed that a sticker file as small as 269 bytes could crash Telegram and freeze a chat, and separately noted that server-side filtering doesn’t catch every malformed case — a fix for that specific issue shipped in Telegram Desktop 7.2.7. Further back, a 2021 analysis from the firm Shielder documented multiple rlottie bugs affecting Telegram’s Android, iOS, and macOS apps. More recently, Cyber Security News has covered a separate Telegram Desktop flaw (CVE-2026-107181) that could let a malicious link steal files or hijack accounts prior to version 7.2.9, as well as the Android-focused “EvilVideo” bug that disguised malicious code as a video file.

The Real Question: Can a Server Check Really Replace Client-Side Security?

Aziz frames his findings around a pointed question for Telegram: if a provider’s own servers are the only thing standing between users and a zero-click bug, is that actually a fix, or is it a design risk dressed up as one? Users have no way to verify what server-side filtering is actually doing on their behalf — they can only trust that it works as claimed.

What Telegram Users Can Do Now

Until Telegram addresses the underlying client-side code, security researchers recommend a few practical precautions: keep the Telegram app updated on every device, restrict who is allowed to message you or add you to groups, and avoid opening stickers, files, or links sent by unknown accounts. ZDI’s general advice in cases like this is similarly conservative — limit your interaction with the affected product until a fix is confirmed.