One sticker and Telegram is hacked: a zero-click hole exposed
A researcher showed in Tokyo how an animated sticker slips past Telegram's defenses and runs code on an iPhone without the victim tapping anything.
Security researcher Saifeldeen Aziz took the stage at OffensiveCon in Tokyo on October 28 with a talk about Telegram stickers. He says a year of work turned up several new zero-click vulnerabilities, the kind where the victim doesn't have to tap anything: receiving a specially built animated sticker is enough.
It started with rlottie, the library that renders animated stickers. Aziz fuzzed it, which means throwing mountains of broken input at a program until it breaks, and used large language models to run that process. That surfaced memory corruption bugs in the iOS, Android and desktop clients. He then found separate logic flaws in how Telegram delivers and checks stickers, got past the server-side validation and ended up running code on Telegram for iOS.
That is a direct challenge to Telegram's own position. In the spring, the Zero Day Initiative, Trend Micro's vulnerability research program, reported an rlottie bug to the messenger. Telegram replied that its servers check every sticker, so a malicious file would never reach the app, and later asked for a complete working exploit chain. ZDI eventually published the flaw as unpatched on October 15, lowering its severity score from 9.8 to 7.0 because of those server checks.
There is some good news. Telegram has already swapped rlottie for tlottie, a new library written in Rust, which rules out most of these memory bugs. It runs in Telegram Desktop, the macOS and Android apps, and on iOS since September. Whether the logic flaws in sticker delivery are fixed is still unknown, and no technical write-up or CVE numbers for the new bugs are public yet.
The verdict is simple: updating Telegram on every device right now is worth doing either way.