Numeric Truncation Vulnerability in Telegram's rlottie Library

CVE-2026-111105

What is CVE-2026-111105?

The Telegram application contains a vulnerability within its rlottie library that allows remote attackers to execute arbitrary code. This issue arises from insufficient validation of user-supplied data, leading to a write operation before the beginning of an allocated buffer. To exploit this vulnerability, an attacker requires the target user to visit a malicious webpage or open a malicious file, allowing them to run code in the context of the current process, potentially compromising system security. Latest advisories underscore the risks associated with this vulnerability.

References