Type Confusion Vulnerability Affecting Telegram on Android, iOS, and macOS
CVE-2021-31318

5.5MEDIUM

Key Information:

Vendor

Telegram

Status
Telegram
Vendor
CVE Published:
18 May 2021
đź”” Create Telegram Vulnerability Alert

What is CVE-2021-31318?

The vulnerability arises from a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function within Telegram's custom implementation of the rlottie library. This flaw allows remote attackers to exploit animated stickers to gain unauthorized access to heap memory on affected devices, potentially leading to arbitrary code execution. Users of Telegram on Android, iOS, and macOS versions prior to 7.1 should be cautious and update their software to mitigate risks.

References

https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-...
x_refsource_MISC
https://www.shielder.it/advisories/telegram-rlottie-lotco...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.