Guide · Security

Telegram sticker flaws: what businesses should do now

Plenty of small firms run customer chats, supplier groups and team updates through Telegram. On 28 October a researcher told a security conference in Tokyo that a booby-trapped sticker could run code on an iPhone without the owner tapping anything, getting past the checks Telegram says make that impossible. Nothing is fixed and nothing is settled. Here is what is known, and what to change on a work phone today.

By Elliot · Published 28 October 2026 · 7 min read

In short

The bugs are in the code Telegram's apps use to draw animated stickers.
One was published unfixed on 15 October. A second researcher claims new ones, and a working chain on iOS.
Telegram says its servers block bad stickers. No fix is announced and no attacks are reported.
Update, limit who can message you, leave spare groups, and keep Telegram off your most important phone.

What happened

A sticker library, a server check, and a seven-month dispute

Animated stickers in Telegram are small animation files that the app draws as soon as they appear in a chat. The drawing is done by rlottie, an open-source library, and drawing a file means reading it. If the reading code trusts a malformed file, the file can push data where it should not go, and a skilled attacker can turn that into running their own code. Telegram has fixed rlottie bugs of this kind before, after research published in 2021.

In March 2026 the Zero Day Initiative (ZDI), part of Trend Micro, reported a new one. Telegram replied that it checks every sticker on its own servers before passing it on, so a malformed one never reaches the app, and asked ZDI for a complete working attack. ZDI declined and, after waiting more than six months, published the bug on 15 October as an advisory with no fix, CVE-2026-111105.

Two weeks later, a separate researcher took the stage at OffensiveCon in Tokyo. His talk's published summary describes a year of work: automated testing of rlottie that found several more memory bugs across Telegram's iPhone, Android and desktop apps, separate flaws in how stickers are delivered and checked that got round the server filter, and the two chained together to run code on Telegram for iOS. He also says the vulnerable drawing code is still in Telegram's official apps.

The Telegram sticker bugs at a glance, as of 28 October 2026
What	Bugs in rlottie, the open-source library Telegram uses to draw animated stickers, plus claimed ways round Telegram's server checks
First report	March 2026, by the Zero Day Initiative (ZDI). Published as an unfixed advisory, CVE-2026-111105, on 15 October 2026
New claim	28 October 2026, a talk at OffensiveCon Tokyo by researcher Saifeldeen Aziz: new bugs, checks bypassed, code run on Telegram for iOS
Apps named	ZDI: Android and Linux. The Tokyo abstract: iOS, Android and Desktop
Telegram's position	In March, that every sticker is checked on its servers before delivery, so the flaw cannot be used. No statement on the Tokyo talk when we checked
Fixed?	No fix announced for either. ZDI's advice is to restrict interaction with the app
Exploited?	No reports of real-world attacks

The timeline

From private report to public stage

Dates from ZDI's advisory, Italy's ACN alert and the OffensiveCon agenda.

203

days from ZDI's private report to its public advisory

Source: ZDI-26-757

9.8 to 7.0

the severity score first quoted, then the one ZDI published

Source: ACN, ZDI

fixes Telegram had announced for sticker bugs when we checked

Source: telegram.org

The score fell because ZDI's formal rating assumes the victim has to do something and that the attack is hard to pull off. The Tokyo research disputes exactly that, so the lower number should not be read as the matter being minor.

How the dispute unfolded in 2026
Date	What happened
26 Mar 2026	ZDI reports a sticker bug to Telegram, first described with a severity score of 9.8 out of 10
28 to 30 Mar	Italy's national cyber agency, ACN, issues an alert, then adds Telegram's formal denial
31 Mar	Telegram tells ZDI the issue is mitigated by server-side validation
14 Apr	Telegram asks for a complete working attack chain. ZDI says that is not how coordinated disclosure works
15 Oct	ZDI publishes it as an unfixed advisory, CVE-2026-111105, scored 7.0 because it needs some user involvement
28 Oct	At OffensiveCon Tokyo, a separate researcher presents new sticker bugs and a chain against Telegram for iOS

Does this matter to me?

Where the risk sits for a small business

Anyone who can put a sticker in front of you is in range. How much it matters depends on the phone.

Most relevant: Telegram on a work phone

If a business number on Telegram talks to customers, suppliers or strangers, that phone is the one this is about. The claim is that a sticker arriving in a chat is enough, with no tap needed, so anyone who can message you is in range.

Higher stakes: one phone for everything

A phone that also holds your banking app, your email, your two-step codes and your client files turns a messaging bug into a business problem. The same bug on a phone used only for Telegram reaches far less.

Also in range: large public groups

Anyone in a big public group can post stickers into it. The privacy setting that limits new chats does not cover groups you have already joined, so a busy community chat is a wider door than your direct messages.

Named in reports: iOS, Android, Desktop

ZDI named Android and Linux in March. The Tokyo abstract says the bugs affect clients on iOS, Android and Desktop, and that the working chain was built for iOS. Nobody has published which versions are affected.

Not affected: people who do not use it

Nobody has said publicly whether Telegram's web version or unofficial apps are affected. If you have Telegram installed but never use it, removing it is the simplest fix of all.

Not the same as: WhatsApp or Signal

These are bugs in how Telegram's own apps draw animated stickers. They say nothing about other messaging apps, which use different code. Each app has its own record, and this news should not be read across.

What to do

Six steps while there is no fix

None of these needs a technician. Steps two and three shrink the number of people who can reach you; the rest limit what a successful attack could get at.

Update Telegram on every device

Install the latest Telegram from the App Store, Google Play or telegram.org on each phone, tablet and computer, including the old laptop that still has it signed in. Be clear about what this does: Telegram has not said any update fixes these bugs, so updating keeps you current for when it does, rather than closing them today.

Limit who can start a chat with you

Telegram Premium and Telegram Business accounts can stop strangers starting new chats, under Settings, Privacy and Security, Messages. Italy's cyber agency suggested exactly this in March. It does not apply to your contacts, to people you messaged first, or to groups, so it narrows the door rather than shutting it.

Leave groups you do not need

Go through the groups and channels on your business account and leave the ones that are not earning their place, especially large public ones where anyone can post. Fewer places where strangers can drop a sticker in front of you is the cheapest step on this list.

Keep the phone itself up to date

Install iOS and Android updates promptly and switch on automatic updates. An attacker who gets code running inside Telegram still has to get past the phone's own defences to do more, and those defences are only as good as the last update. Retire phones that no longer receive updates.

Separate the business from the phone

Where Telegram is a must, consider running it on a phone that does not also hold your bank, your email and your two-step codes. If customers reach you through it, a contact form on your own website and a business email address give them a route you control, and one that is not tied to a single app's security record.

Report anything odd, and watch for the fix

If Telegram crashes when a chat opens, or a sticker will not display, report the sender in the app and tell whoever looks after your IT. Then watch Telegram's release notes and ZDI's advisory for a fix, and update as soon as one names stickers or rlottie.

Weighing the claims

Shown, claimed, and still in dispute

Shown in public: that rlottie, as Telegram uses it, has at least one memory bug that ZDI judged serious enough to publish without a fix, and that Telegram's answer rests on its server check rather than on changing the app. Claimed, and not yet public in detail: the new bugs, the bypass of that check, and the working chain on iOS. We have the talk's summary, not its slides or code, and the summary itself says the exploit has limitations it goes on to discuss.

Disputed: whether a server check counts as a fix. Telegram's view is that if a bad sticker can never be delivered, the bug in the app cannot be reached. The researchers' view is that one bypass undoes that for every user at once, and that the code should be fixed where it runs. Both positions are reasonable on their own terms, and only the evidence presented in Tokyo can settle which holds today.

Our advice does not wait on that argument. A messaging app that accepts content from strangers is always a way in, and a phone that holds the whole business makes any such way in expensive. We will update this page when Telegram responds, the slides are published, or a fixed release appears.

FAQ

Telegram sticker questions, answered

What is the Telegram sticker vulnerability?

It is a set of reported bugs in rlottie, the open-source library Telegram's apps use to draw animated stickers. A malformed sticker could corrupt the app's memory and, in the worst case, let an attacker run code on the device. The first was reported to Telegram in March 2026 by the Zero Day Initiative and published, unfixed, as CVE-2026-111105 on 15 October 2026. More were presented at OffensiveCon Tokyo on 28 October 2026.

Is Telegram safe to use after the sticker claims?

Telegram says yes, because it checks every sticker on its servers before delivery. The researcher who spoke in Tokyo says he found ways past those checks and ran code on Telegram for iOS. Neither side's evidence was public when we checked, and there are no reports of attacks. For a business, the sensible answer is to keep using it if you must, with the steps on this page, and not to rely on it for anything you could not afford to lose.

Has Telegram fixed the sticker bug?

Not that it has announced. In March and April Telegram told the Zero Day Initiative the issue was mitigated by server-side validation and asked for a complete attack chain, and ZDI published its advisory on 15 October 2026 with no vendor fix. As of 28 October 2026 we found no Telegram release note or statement naming a sticker or rlottie fix.

What does zero-click mean?

It means the victim does not have to tap a link, open a file or accept anything. In this case the claim is that receiving a sticker in a chat is enough, because the app draws it automatically. Zero-click bugs are rare and valuable, which is why they are usually used against chosen targets rather than sprayed at everyone.

Why was the severity score cut from 9.8 to 7.0?

The first reports in March quoted 9.8 out of 10. ZDI's published advisory scores it 7.0 because its formal rating assumes some user involvement and harder conditions. The Tokyo research argues the real risk is higher, since it claims a chain that needs no tap. Treat the number as a rough guide and the steps as the useful part.

Can I stop Telegram showing stickers?

Not completely. Telegram has options to stop animations playing, but nobody has shown that they stop a malicious sticker being processed, so we do not recommend relying on them. Limiting who can message you, leaving groups you do not need and keeping Telegram off your most important phone are the steps that reduce exposure.

References