Key points
- The vulnerability allows remote attackers to execute arbitrary code on affected Telegram installations.
- Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page.
- Zero Day Initiative reports the vendor previously claimed server-side mitigation was sufficient.
Telegram installations are affected by a remote code execution vulnerability tracked as CVE-2026-111105. The Zero Day Initiative (ZDI) published an advisory for this flaw on October 15, 2026. Researchers assigned the issue a CVSS score of 7.0. The specific defect resides within the rlottie library. The flaw stems from insufficient validation of user-supplied data. This lack of validation can cause a write operation before the start of an allocated buffer. Such an error allows an attacker to run code in the context of the current process.
In plain English
The bug lives in the rlottie library included in Telegram. When the application processes certain inputs, it does not check the data properly. This mistake lets the software write information into memory areas it should not access. An attacker can craft a file or a web page that triggers this error. If a user opens that file or visits that page while using Telegram, the attacker gains control. The attacker’s code runs with the same permissions as the Telegram application itself.
The background
ZDI reported this vulnerability to the vendor on March 26, 2026. The vendor acknowledged receipt the next day. On March 31, 2026, the vendor stated that server-side validation had already mitigated the issue. ZDI clarified the exploitability on April 7, 2026, and requested updates on April 13. The vendor asked for a complete remote code execution chain on April 14. ZDI argued that requiring a full chain conflicted with industry standards. After further inquiries, ZDI notified the vendor of its intent to publish the case as a zero-day advisory on July 30, 2026.
What changes now
The advisory confirms that the vendor stated the vulnerability was mitigated by server-side validation. However, ZDI published the advisory as a zero-day case, indicating the issue remains a concern. The ZDI notes that the only effective mitigation strategy is to restrict interaction with the product. Users must remain cautious about external content. This situation mirrors other recent incidents where client-side protections were essential, similar to the Kiro IDE update reported by Patch Review on October 15, 2026.
Who needs to act first
Teams managing enterprise communications should prioritize restricting access to untrusted media. Administrators usually implement strict content filters to block unsolicited files and links. It is advisable to test any new filtering rules in a isolated environment before wide deployment. Backing up critical configuration files ensures recovery if changes cause issues. Since no software update exists, reducing the attack surface by limiting what users can open is the primary defense. Monitor logs for unusual application behavior closely.
What to do and how to stay safe: Telegram
- Configure messaging clients to block automatic loading of media from unknown sources.
- Train users to avoid opening unsolicited files or clicking links in messages.
- Monitor application logs for unexpected crashes or unusual process activity.
- Restrict administrative privileges for standard users to limit potential damage.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability require me to click a link or open a file?
Yes, user interaction is required; the target must visit a malicious page or open a malicious file to trigger the exploit.
Has Telegram released a fix for this remote code execution flaw?
The source material states the vendor claimed the vulnerability was mitigated by server-side validation, but ZDI published it as a zero-day advisory.
What is the severity rating for CVE-2026-111105?
The Zero Day Initiative assigned a CVSS rating of 7.0 to this vulnerability.
