FHN 
A security investigation into Telegram has raised concerns about how the messaging app handles animated stickers. Researcher Saifeldeen Aziz claims that multiple weaknesses can be combined into an attack that runs code on an iPhone without requiring the user to tap a link or open a suspicious file.
The research was scheduled to be presented at OffensiveCon in Tokyo on October 28, 2026. It focuses on weaknesses in Telegram’s sticker-processing code and the possibility of bypassing checks designed to block unsafe content.
The findings come amid an earlier disagreement between Telegram and the Zero Day Initiative (ZDI) over a separate security issue involving the same animation-processing technology.
Researchers Investigate Telegram’s Sticker Protection
Animated stickers may look harmless, but the application must process their underlying data before displaying them. If that processing code contains a memory-handling error, specially crafted content could potentially trigger unexpected behavior.
ZDI previously documented a Telegram vulnerability as CVE-2026-111105. The issue affects the rlottie library and involves incorrect handling of numeric values that can result in a memory write outside its intended boundaries.
Telegram argued that checks performed on its servers reduced the likelihood of exploitation. However, the vulnerability report raised concerns about weaknesses that remained in the application itself.
Aziz’s investigation reportedly went further by examining both the animation library and the way Telegram handles incoming stickers. He says he discovered several memory-corruption and logic issues across different Telegram clients.
The reported research suggests that combining these weaknesses could allow an attacker to bypass existing safeguards and execute code on iOS. The exact exploit requirements and impact still need to be established through the full technical disclosure.
How Multiple Weaknesses Could Form an Attack Chain
The research focuses on more than one potential security weakness. Rather than relying on a single bug, the reported method combines problems in animation processing with flaws in the handling and validation of sticker content.
The main areas of concern include:
- Memory safety: Incorrect processing of animation data may cause memory corruption.
- Content validation: Weaknesses in sticker delivery or checking could allow unexpected data to reach vulnerable code.
- Exploit chaining: Combining separate bugs may overcome protections that limit the impact of an individual vulnerability.
- Cross-platform exposure: The researcher reported findings involving iOS, Android, and Desktop versions of Telegram.
These claims are based on the research abstract, not a fully verified technical demonstration. The available information does not establish whether the newly reported issues have been patched or whether attacks have occurred in the wild.
Previous reports have also linked Telegram’s sticker-processing components to application crashes and other security weaknesses. However, those earlier findings are separate from the latest claimed iOS attack chain.
Steps Users and Security Teams Should Take
Until more technical details become available, Telegram users should keep their applications updated and remain cautious when receiving unexpected content.
Recommended precautions include:
- Install the latest Telegram version available for your device.
- Review privacy settings for messages, groups, and unknown contacts.
- Avoid interacting with suspicious content from unfamiliar accounts.
- Monitor official Telegram security announcements for confirmed fixes.
Application developers should also ensure that security checks are enforced within client software rather than relying entirely on server-side filtering.
The key takeaway: A media-processing vulnerability can become more serious when combined with weaknesses elsewhere in an application. However, the severity of this reported Telegram attack cannot be confirmed until the full technical findings and remediation status are available.
About the Author
