CVE-2026-111105
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A remote code execution vulnerability in the rlottie library used by Telegram, caused by lack of proper validation of user-supplied data, resulting in a write before the start of an allocated buffer. Exploitation requires user interaction — visiting a malicious page or opening a malicious file.
Risk Assessment
An attacker can execute arbitrary code in the context of the victim's process, potentially leading to full system compromise.
Recommendation
Update Telegram to the latest version containing the rlottie fix. Avoid opening untrusted files and visiting suspicious pages.
Other vulnerabilities in rlottie
See all- CVE-2026-108978Medium
Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows buffer overflow via environment variables. Affects version e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.
- CVE-2026-91826Medium
A stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption when rendering crafted vector animations. This issue affects rLottie version 480a2ad0c5d2e45458c545b8213279e9e8b71e39.
- CVE-2026-49509Medium
Vulnerability in Samsung Opensource rLottie (version 25648aef19187b3f87f4d9420b8d761453ad4630) causes an out-of-bounds read, potentially leading to buffer overread.
- CVE-2026-82797Medium
Uncontrolled recursion in Samsung Open Source rlottie allows processing of serialized data with nested payloads, potentially leading to system overload or denial of service. Affects versions before 8de0d9e6ca80ffef654965505981727b9fa06a51.
- CVE-2026-19588Medium
In Samsung Open Source rlottie, an integer overflow vulnerability leads to buffer overflow, potentially allowing arbitrary code execution.
- CVE-2026-19587Medium
In Samsung Open Source rlottie, an uncontrolled resource consumption vulnerability leads to excessive memory allocation.
- CVE-2026-19518Medium
A vulnerability in Samsung Open Source rlottie involves improper validation of specified quantity in input, allowing input data manipulation.
- CVE-2026-19517Medium
A vulnerability in Samsung Open Source rlottie involves improper validation of specified quantity in input and allocation of resources without limits or throttling, allowing excessive allocation.
- CVE-2026-18772Medium
The Samsung Open Source rlottie library has a vulnerability in improperly controlled sequential memory allocation, allowing Exponential Data Expansion.
- CVE-2026-15551Medium
An integer overflow or wraparound vulnerability in Samsung Open Source rlottie leads to buffer overflows. This issue could allow an attacker to execute code or cause a crash.
Original NVD description (English source)
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS