A security researcher has revealed how vulnerabilities in Telegram's animated stickers could let hackers run malicious code on iPhones without users tapping anything.
Saifeldeen Aziz presented his findings at OffensiveCon in Tokyo on 28 October 2026, explaining how attackers could combine software flaws to bypass Telegram's security checks.
The research challenges Telegram's earlier position that server-side filtering could prevent malicious stickers from reaching vulnerable software. Aziz identified weaknesses affecting Telegram on iOS, Android and desktop computers. His reported attack chain achieved code execution within the iPhone app without user interaction.
However, the exploit has reportedly been addressed.
On 29 October, independent news channel Telegram Info reported that Aziz had confirmed the issue was resolved after Telegram replaced its vulnerable animation-rendering library. According to the report, users running the latest official applications are protected.
How Telegram Stickers Could Trigger an Attack Without a Tap
Most online scams depend on someone clicking a malicious link or opening an attachment. A zero-click attack works differently. It exploits vulnerable software without requiring the victim to interact with malicious content.
Aziz's research focused on rlottie, a library previously used by Telegram to display animated stickers. According to his OffensiveCon presentation abstract, he spent approximately a year investigating Telegram's security weaknesses.
Using artificial intelligence to help automate fuzzing, a technique that tests software with unexpected or malformed data, Aziz identified multiple memory-corruption vulnerabilities affecting Telegram clients across iOS, Android and desktop platforms.
The researcher also discovered weaknesses in Telegram's sticker delivery and validation systems. By combining these flaws, he reported bypassing safeguards designed to prevent malicious animations from reaching vulnerable code. The resulting attack chain achieved code execution in Telegram for iOS without user interaction.
However, executing code within Telegram does not automatically mean an attacker can take complete control of an iPhone. Aziz's public abstract does not establish that his exploit could bypass Apple's wider operating system protections.
Telegram's Earlier Security Defence Faces New Questions
The research follows an earlier dispute over Telegram's protections against malicious animated stickers.
On 26 March 2026, Michael DePlante of TrendAI's Zero Day Initiative (ZDI) reported a vulnerability affecting Telegram's rlottie library. According to Aziz's conference abstract, the flaw initially carried a severity score of 9.8 out of 10, which was later reduced to 7.0.
According to ZDI's disclosure timeline, Telegram said on 31 March that server-side validation had mitigated the vulnerability. However, ZDI continued raising concerns about the underlying software weakness.
On 15 October, ZDI published advisory ZDI-26-757, identifying the vulnerability as CVE-2026-111105. It described a numeric truncation flaw that could cause memory corruption and potentially allow malicious code to execute within Telegram's process.
Unlike Aziz's reported attack chain, the earlier advisory specified that user interaction was required. The target would need to visit a malicious page or open a malicious file.
Aziz's findings went further by showing how weaknesses in sticker validation and delivery could expose vulnerable code without requiring a tap. His research raised questions about whether server-side filtering alone was sufficient to protect users.
Has Telegram Fixed the Sticker Vulnerability?
Telegram has reportedly addressed Aziz's demonstrated exploit by replacing rlottie with tlottie, an animation-rendering library written in Rust.
On 29 October, Telegram Info, an independent channel covering the messaging platform, reported that Aziz had confirmed the replacement resolved the problem. The report said users running the latest official Telegram applications were protected.
The transition had already begun before Aziz's conference presentation.
According to Telegram Info, tlottie was being used in Telegram's Android, desktop and macOS applications, while the iOS version adopted it in September 2026.
Rust is designed to prevent several classes of memory-safety errors. However, adopting the programming language does not automatically eliminate every possible security flaw.
The available sources do not independently establish whether all the separate sticker-delivery and validation weaknesses have been corrected.
Aziz's full technical presentation materials were also unavailable in the sources reviewed. This leaves the exact software versions and conditions involved in his demonstration unclear.
What iPhone Users Should Do
For iPhone users, the most practical precaution is to update Telegram through Apple's App Store. Installing the latest official version helps ensure that available security fixes are applied.
Keeping iOS updated is also advisable. However, an operating system update would not necessarily resolve a vulnerability within Telegram itself.
Users should remain cautious about suspicious links and unexpected attachments. That advice remains useful for general security, although it would not necessarily prevent a genuine zero-click attack.
The sources reviewed did not identify any publicly confirmed cases of criminals exploiting Aziz's reported attack chain against ordinary Telegram users.
The research nevertheless highlights a wider concern for messaging applications. Server-side filtering can block malicious content, but weaknesses in those checks may allow dangerous files to reach vulnerable software.
Telegram's reported replacement of rlottie appears to address the exploit demonstrated by Aziz. However, the findings show why messaging applications need strong protections within their own software, even when incoming content appears to be nothing more than an animated sticker.
