Back to Intelligence

CVE-2026-111105: Unpatched Telegram rlottie Zero-Day Enables Unauthenticated Code Execution — Detection and Mitigation Guide

SA
Security Arsenal Team
October 15, 2026
12 min read

The Zero Day Initiative has published ZDI-26-757, disclosing an unpatched numeric truncation vulnerability in Telegram's rlottie animation library — tracked as CVE-2026-111105 with a CVSS score of 7.0 (High). The flaw allows remote attackers to execute arbitrary code on affected Telegram installations. The only mitigating factor is the user interaction requirement: the target must visit a malicious page or open a malicious file — in practical terms, that means rendering a weaponized animated sticker (Telegram's .tgs format, which is a gzipped Lottie JSON animation parsed by rlottie).

This is the scenario vulnerability management teams dread most: a publicly disclosed zero-day with no vendor fix, affecting a messaging application with nearly a billion users worldwide, embedded deep inside enterprises as a shadow-IT communication channel. Telegram is not just a consumer app — we routinely find Telegram Desktop installed on corporate endpoints during IR engagements, often outside any software inventory or patch management scope. An unauthenticated RCE reachable through something as innocuous as an animated sticker is a high-value initial access primitive for both crimeware and nation-state operators.

This post breaks down the vulnerability, what exploitation plausibly looks like on the wire and on the endpoint, and — because there is no patch — the compensating controls, detection content, and hunting queries your SOC should deploy today.

Technical Analysis

Affected Component and Products

  • Affected library: rlottie — the Samsung-origin C++ Lottie animation rendering library that Telegram forked and embedded to render animated stickers
  • Affected products: Telegram clients that bundle rlottie — this includes Telegram Desktop (Windows, macOS, Linux) and potentially mobile builds depending on how the library is linked. Telegram Desktop is the highest-risk enterprise target.
  • Vulnerability type: Numeric truncation (CWE-197) leading to memory corruption
  • CVE / Advisory: CVE-2026-111105 / ZDI-26-757
  • CVSS: 7.0 (High) — reflecting the user-interaction requirement that tempers an otherwise critical unauthenticated RCE
  • Patch status: None. This is a zero-day disclosure. ZDI's publication of the advisory indicates the coordinated disclosure timeline with the vendor expired without a fix being released.

How the Vulnerability Works

A numeric truncation bug occurs when a value is copied from a larger integer type into a smaller one, silently discarding high-order bits. In a parsing/rendering context, this typically means a length, count, offset, or dimension field declared by the attacker in the animation file is validated as (for example) a 64-bit or 32-bit value, but later consumed as a 16-bit or 8-bit value — or truncated during a signedness conversion.

From a defender's perspective, the attack chain looks like this:

  1. Delivery: The attacker sends or hosts a malicious Lottie animation. In Telegram's ecosystem this is most naturally a .tgs animated sticker (gzip-compressed JSON), but rlottie parsing can also be reached via animated emoji, sticker packs shared through channels, or files opened from any source. The ZDI advisory notes the target must "visit a malicious page or open a malicious file" — consistent with rendering attacker-controlled animation content.
  2. Parsing: The victim's Telegram client hands the animation to rlottie. A dimension, frame count, or object-count field in the JSON passes validation at full width.
  3. Truncation: During allocation or indexing, the value is truncated to a narrower type. The classic consequence is an undersized heap allocation paired with a full-width copy/write loop — a heap buffer overflow — or an out-of-bounds index into a structure array.
  4. Corruption & execution: The attacker shapes the animation content to groom the heap and overwrite adjacent control data, achieving arbitrary code execution within the context of the Telegram process — i.e., with the victim user's privileges and any session data (messages, contacts, files) the client can access.

The critical defensive implication: code execution happens inside Telegram.exe (or the platform equivalent) itself. There is no separate vulnerable service. Anything that follows — payload staging, C2, credential theft — will originate from or be parented by the Telegram process.

Exploitation Status

  • Patch available: No. Unpatched at time of disclosure.
  • Public PoC: ZDI advisories of this class are typically published with a proof-of-concept or detailed root-cause write-up; assume working exploit code will circulate.
  • Active exploitation: Not confirmed at time of writing, but treat as imminent. Messaging-app zero-days with public technical details are weaponized quickly, and Telegram's user base includes high-value targets.
  • CISA KEV: Not listed at time of writing — monitor for addition.

The exposure window starts now and lasts until Telegram ships a patched rlottie build and your fleet actually receives it. For an application frequently installed outside enterprise software management, that window will be long unless you force it closed.

Detection & Response

Because exploitation executes inside the Telegram process, our detection strategy focuses on three observables:

  1. Telegram spawning child processes — legitimate Telegram Desktop almost never spawns command interpreters, script engines, or unsigned binaries.
  2. Suspicious .tgs / sticker artifacts written outside expected Telegram cache paths.
  3. Telegram making anomalous network connections (e.g., to non-Telegram infrastructure, or process hollowing/follow-on payload retrieval).

Sigma Rules

YAML
---
title: Telegram Desktop Spawning Suspicious Child Process
id: 3c8f2a71-9b4d-4e6a-b1c2-7f5d8a9e0c31
status: experimental
description: Detects Telegram.exe spawning command interpreters, script engines, or other suspicious child processes, consistent with post-exploitation activity following CVE-2026-111105 (rlottie numeric truncation RCE). Legitimate Telegram Desktop operation does not spawn these children.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-757/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Telegram.exe'
      - '\Telegram Desktop.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; Telegram may invoke a system browser or updater, but never script engines or LOLBins
level: critical
---
title: Telegram Desktop Establishing Connection to Non-Telegram Infrastructure
id: 8e1d4b62-5c7a-4f39-a2d8-6b3e9c0f1a42
status: experimental
description: Detects Telegram.exe establishing outbound connections to rare or suspicious destinations. Telegram clients communicate with Telegram MTProto infrastructure (91.108.0.0/16, 149.154.0.0/16, 95.161.64.0/20 ranges); connections to unrelated hosts may indicate payload retrieval following CVE-2026-111105 exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-757/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\Telegram.exe'
      - '\Telegram Desktop.exe'
    Initiated: 'true'
  filter_telegram_cdn:
    DestinationIp|startswith:
      - '91.108.'
      - '149.154.'
      - '95.161.64.'
      - '2001:67c:4e8:'
      - '2001:b28:f23'
  condition: selection and not filter_telegram_cdn
falsepositives:
  - Link preview fetches and inline bot content retrieval to third-party hosts; tune with destination reputation lookup
level: medium
---
title: Suspicious Animated Sticker File Written Outside Telegram Cache
id: 5f2a9c83-1d6e-4b48-93a7-2c4f7e8b0d53
status: experimental
description: Detects .tgs (Telegram animated sticker) files written to staging locations outside Telegram's data directories, such as temp, downloads staged by scripts, or public folders - consistent with pre-staged delivery of a weaponized rlottie animation for CVE-2026-111105.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-757/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.tgs'
  filter_legit:
    TargetFilename|contains:
      - '\Telegram Desktop\tdata\'
      - '\Telegram Desktop\Telegram Desktop\'
  condition: selection and not filter_legit
falsepositives:
  - Users exporting stickers intentionally; security researchers collecting samples
level: medium

KQL — Microsoft Sentinel / Defender for Endpoint

This query hunts for post-exploitation behavior patterns around the Telegram process: suspicious children, unsigned binaries spawned from Telegram's directory, and anomalous network destinations. Run it as a scheduled hunting query across your fleet.

KQL — Microsoft Sentinel / Defender
// Hunt: Post-exploitation activity originating from Telegram Desktop
// Context: CVE-2026-111105 - rlottie numeric truncation RCE (ZDI-26-757, unpatched)
let Lookback = 14d;
let TelegramChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","curl.exe","wget.exe","msbuild.exe","installutil.exe","regsvcs.exe"]);
let SuspiciousChildren =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "Telegram.exe"
       or InitiatingProcessFolderPath has "Telegram Desktop"
    | where FileName in~ (TelegramChildren)
    | project TimeGenerated, DeviceName, AccountName,
              ParentProcess = InitiatingProcessFileName,
              ChildProcess = FileName, ProcessCommandLine,
              InitiatingProcessCommandLine, SHA256, ReportId;
let TelegramNetAnomaly =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "Telegram.exe"
    | where ActionType == "ConnectionSuccess"
    // Telegram MTProto/CDN infrastructure ranges
    | where not(RemoteIP startswith "91.108." or RemoteIP startswith "149.154." or RemoteIP startswith "95.161.")
    | where not(RemoteUrl has_any ("telegram.org","t.me","telegram.me","cdn4.telegram-cdn.org") or isempty(RemoteUrl) and RemoteIPType == "Private")
    | summarize ConnectionCount = count(), Destinations = make_set(RemoteUrl, 20), IPs = make_set(RemoteIP, 20)
      by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
    | where ConnectionCount > 25;
SuspiciousChildren
| union TelegramNetAnomaly
| sort by TimeGenerated desc

Velociraptor VQL

Use this artifact for rapid fleet-wide triage: it enumerates running Telegram processes, any child processes they have spawned, and their active network connections — everything an analyst needs to spot a compromised client in a single collection.

VQL — Velociraptor
-- Artifact: Telegram rlottie exploit triage (CVE-2026-111105)
-- Collects Telegram processes, their children, and network connections

LET telegram_procs = SELECT Pid, Name, Exe, Username, CreateTime, CommandLine
FROM pslist()
WHERE Name =~ '(?i)telegram' OR Exe =~ '(?i)telegram'

LET telegram_children = SELECT Pid, Ppid, Name, Exe, CommandLine, CreateTime, Username
FROM pslist()
WHERE Ppid in (SELECT Pid FROM telegram_procs)

LET telegram_conns = SELECT Pid, Name, Status,
  Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
  Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Pid in (SELECT Pid FROM telegram_procs)

SELECT * FROM telegram_procs
UNION ALL
SELECT Pid, Name, Exe, Username, CreateTime, CommandLine FROM telegram_children

Verification & Hardening Script

Until Telegram ships a patched build, this PowerShell script inventories Telegram Desktop installations across an endpoint, reports version and install path (including non-standard user-context installs, which evade most asset inventories), and optionally enforces a temporary containment policy by blocking execution via AppLocker-style Software Restriction Policy or renaming the binary — use the -Contain switch only where business impact permits.

PowerShell
# CVE-2026-111105 - Telegram rlottie zero-day triage and containment
# Run elevated. Default mode: inventory + report. -Contain: block execution until patched.
param(
    [switch]$Contain,
    [string]$ReportPath = "$env:ProgramData\Telegram_ZeroDay_Triage_$(Get-Date -Format yyyyMMdd_HHmmss).csv"
)

$findings = @()
$searchRoots = @(
    "$env:ProgramFiles", "${env:ProgramFiles(x86)}",
    "$env:LOCALAPPDATA", "$env:APPDATA"
)

# Also enumerate per-user profile install locations (Telegram frequently installs per-user)
$userProfiles = Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue
foreach ($profile in $userProfiles) {
    $searchRoots += "$($profile.FullName)\AppData\Roaming"
    $searchRoots += "$($profile.FullName)\AppData\Local"
}

foreach ($root in ($searchRoots | Select-Object -Unique)) {
    if (-not (Test-Path $root)) { continue }
    Get-ChildItem -Path $root -Filter 'Telegram.exe' -Recurse -ErrorAction SilentlyContinue |
        ForEach-Object {
            $ver = $_.VersionInfo.ProductVersion
            $findings += [PSCustomObject]@{
                Path        = $_.FullName
                Version     = $ver
                LastWrite   = $_.LastWriteTime
                Patched     = 'UNKNOWN - no fixed version published; treat all versions as vulnerable'
                Contained   = $false
            }
        }
}

if ($findings.Count -eq 0) {
    Write-Host "[+] No Telegram Desktop installations found." -ForegroundColor Green
} else {
    Write-Host "[!] Found $($findings.Count) Telegram installation(s) - ALL currently vulnerable (no patch exists):" -ForegroundColor Yellow
    $findings | Format-Table Path, Version, LastWrite -AutoSize

    if ($Contain) {
        foreach ($f in $findings) {
            try {
                # Stop running instances
                Get-Process -Name 'Telegram' -ErrorAction SilentlyContinue | Stop-Process -Force
                # Deny-execute ACL on the binary pending vendor patch
                $acl = Get-Acl $f.Path
                $deny = New-Object System.Security.AccessControl.FileSystemAccessRule(
                    'Everyone','ReadAndExecute','Deny')
                $acl.AddAccessRule($deny)
                Set-Acl -Path $f.Path -AclObject $acl
                $f.Contained = $true
                Write-Host "[+] Execution blocked: $($f.Path)" -ForegroundColor Cyan
            } catch {
                Write-Warning "Failed to contain $($f.Path): $_"
            }
        }
        Write-Host "[!] REMEMBER: revert deny-ACLs immediately when Telegram ships the patched build." -ForegroundColor Magenta
    }
}

$findings | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "[i] Report written to $ReportPath"

Remediation

There is no patch. Remediation for this vulnerability is a compensating-controls exercise, and it needs to be executed now, not when the fix drops.

1. Immediate (today):

  • Inventory Telegram across the fleet. Use the script above plus your EDR software inventory. Telegram Desktop's per-user, no-admin install model means SCCM/Intune catalogs frequently miss it. You cannot protect what you haven't counted.
  • Enforce application control where feasible. If Telegram has no approved business use, block it via AppLocker, WDAC, or your EDR's application control module. This is the single most effective mitigation for an unpatched client-side RCE.
  • Deploy the detection content above. The "Telegram spawning a child process" Sigma rule is high-fidelity and low-noise — ship it to production immediately at critical severity.
  • Alert on the advisory. Subscribe to the ZDI-26-757 advisory and Telegram's release channels so the patch triggers an emergency-change window the moment it ships.

2. Short term (this week):

  • User awareness with specifics. Tell users plainly: do not open animated stickers, sticker packs, or files from unknown contacts, channels, or forwarded messages until further notice. Generic "be careful" messaging fails; a named threat tied to a concrete action does not.
  • Segment and monitor. Telegram-exposed endpoints in sensitive segments (executives, finance, admins) should get enhanced EDR telemetry retention and priority alerting on the KQL hunt above.
  • Review egress policy. Telegram's legitimate traffic is confined to well-known MTProto/CDN ranges. Alerting or restricting Telegram process traffic outside those ranges both detects payload staging and constrains an attacker's post-exploitation options.

3. When the patch lands:

  • Treat it as an emergency patch — 72-hour deployment target for a public zero-day RCE in an internet-facing content parser. If CISA adds CVE-2026-111105 to the KEV catalog, federal agencies will face the standard KEV remediation deadline; private sector should mirror that urgency.
  • Verify the fixed version explicitly references CVE-2026-111105 / the rlottie fix before closing the exposure window — do not assume any new version includes it.
  • Rollback the containment. Remove any deny-ACLs or execution blocks promptly to avoid breaking users once a fixed build is deployed.

4. Strategic:

  • Fold this into your shadow-IT messaging app policy. Consumer messaging clients with rich media parsers (stickers, GIFs, document previews) are recurring RCE targets. An approved-software list enforced by application control is the durable fix, not per-CVE whack-a-mole.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

criticalzero-daycvepatch-tuesdayexploitvulnerability-disclosuretelegramcve-2026-111105rlottieremote-code-execution

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action