CVE-2026-111105

Executive Summary

CVE-2026-111105 is a remote code execution vulnerability in the rlottie animation-parsing library as used by Telegram, caused by a numeric truncation flaw (CWE-197) that leads to an out-of-bounds write before the start of an allocated buffer when processing attacker-supplied animation data. An attacker can trigger the flaw by convincing a target user to open a malicious page or file, resulting in code execution in the context of the current process. No patch, public PoC, or exploit code has been identified — the vulnerability is currently UNPATCHED per all tracked sources.

Technical Analysis

The vulnerability resides within the rlottie library, a standalone C++ rendering engine for Lottie JSON-based vector animations. rlottie is embedded in multiple applications as an animation rendering component, and here it is present in affected Telegram installations. The ZDI identifier ZDI-CAN-30207 confirms this is a Trend Micro Zero Day Initiative case, indicating coordinated vulnerability disclosure.

The root cause is classified as CWE-197: Numeric Truncation Error. Per the NVD description, the flaw exists because the library fails to properly validate user-supplied data, and this validation gap results in a write before the start of an allocated buffer — a form of out-of-bounds (OOB) write occurring at a negative offset relative to the buffer base pointer. Numeric truncation errors typically arise when a value of a wider integer type (e.g., 64-bit) is implicitly narrowed to a smaller type (e.g., 32-bit) without bounds checking, or when a signed/unsigned conversion produces an unexpected result. When such a truncated value is subsequently used as an offset, length, or index into a buffer, the resulting pointer arithmetic can point outside the allocated region.

In this case the outcome is specifically a write occurring before the buffer start. This is a particularly dangerous primitive: the memory immediately preceding a heap allocation may contain allocator metadata, adjacent object headers, or other control data. Corruption of this region can lead to arbitrary code execution, and it is frequently leveraged in modern exploitation to achieve controlled memory corruption with reliable primitive development.

No further code-level detail (specific function names, parsing stages, or affected file paths within rlottie) is available in the provided intelligence. The exact truncation point and the field of the Lottie payload that triggers it cannot be stated without fabrication and are therefore omitted.

Attack surface: any code path in Telegram that parses and renders Lottie animation content originating from an untrusted source. Because Lottie files may be delivered as standalone files or embedded in web/sticker content, the attacker-controlled input is the animation payload itself.

Exploitation requires user interaction (UI:R), consistent with the client-side nature of the flaw — the target must open a malicious page or file. The CVSS 3.0 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates local attack vector, high attack complexity (suggesting the attacker must defeat memory protections such as ASLR or other mitigations to achieve reliable exploitation), no privileges required, and full impact across confidentiality, integrity, and availability within the process scope.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-111105. The attack chain below is described strictly at the vulnerability-class level based on the NVD description; no specific function, parameter, or file-format field names are asserted because none are provided in the source data.

1. Reconnaissance / target identification. The attacker identifies a target running an affected Telegram installation that renders rlottie-based Lottie animation content. Because the vulnerable component is the animation-parsing library, any deployment where Telegram processes Lottie content from external sources is in scope. Attackers may profile targets by version fingerprinting or by luring users to controlled content regardless of specific version.

2. Delivery and trigger. The attacker crafts malicious Lottie animation content and delivers it so the victim opens it — either via a malicious web page that serves the animation or via a malicious file the victim is induced to open. This satisfies the UI:R requirement: exploitation only proceeds if the user interacts with the crafted content.

3. Triggering the numeric truncation. During parsing/rendering of the crafted animation, a user-supplied numeric value is truncated without proper validation (CWE-197). The improperly narrowed value is subsequently used as an offset/index, producing a write at a negative offset relative to an allocated buffer — i.e., before the start of the buffer. This is the corruption primitive.

4. Payload / execution at the vulnerability-class level. The attacker leverages the OOB write-before-buffer primitive to corrupt adjacent memory (for example, allocator metadata or object control data) and, in doing so, redirects control flow to attacker-chosen code. The high attack-complexity rating reflects the need to overcome memory protections; the process context in which the vulnerable library executes determines the privilege level of the executed code. No specific technique (e.g., ROP, heap feng shui) is claimed here since the source data does not describe it.

5. Post-exploitation impact. Successful exploitation grants arbitrary code execution in the context of the current process (the Telegram client process). Given the CVSS impact ratings (C:H/I:H/A:H), this yields full loss of confidentiality, integrity, and availability within that process — including access to the process's memory, data, and the user's session within the affected application.

Impact Assessment

Per the CVSS 3.0 base metrics, the impact of this vulnerability is rated High across all three CIA dimensions (C:H/I:H/A:H), meaning successful exploitation results in total loss of confidentiality, integrity, and availability of the impacted process. The scope is Unchanged (S:U), meaning the vulnerable process cannot directly affect resources beyond its own security authority — impact is confined to the Telegram process and its accessible resources, not a system-wide privilege escalation beyond the user running the application.

• Attack Vector (AV:L) and Attack Complexity (AC:H): the local vector with high complexity indicates exploitation is non-trivial and typically requires defeating memory mitigations. This lowers the practical likelihood of mass exploitation but does not eliminate risk for high-value targets.
• User Interaction (UI:R): the victim must open a malicious page or file, which is the key business-risk driver — user awareness and content-handling controls directly influence exposure.
• Base Score 7.0 (High).

Business impact: successful exploitation enables arbitrary code execution on a user's endpoint in the context of the Telegram process, potentially exposing message content, media, session tokens, and local files accessible to that process. Blast radius is process-scoped per the CVSS scope metric, but an endpoint compromise of a communications client is a high-value outcome for targeted intrusion. The affected population is any user running an unpatched Telegram build that bundles the vulnerable rlottie version.

Because no EPSS score is available (not scored by FIRST.org) and the CVE is not in CISA KEV, there is no current evidence of active, widespread exploitation. However, the combination of remote-triggerable content delivery, full CIA impact, and an unpatched state elevates the strategic risk for well-resourced adversaries pursuing targeted attacks.

Detection Guidance

Note: because the vulnerable parsing routine and the exact Lottie payload structure are not described in the source data, the following detections are written at the class level — targeting the delivery vectors (malicious Lottie files/pages) and anomalous process behavior (OOB-write corruption) rather than a specific byte sequence. These rules are detection scaffolding; they should be tuned against the environment and the eventual vendor advisory when published.

Sigma Rule

title: Telegram rlottie Numeric Truncation Attempt - Suspicious Lottie File Load
id: 7e2d19a4-8c33-4d61-9f0b-cve2026-111105
status: experimental
description: Detects the opening of Lottie animation files by Telegram processes, associated with potential exploitation of CVE-2026-111105 (rlottie numeric truncation OOB write).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-111105
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1203
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\Telegram.exe'
  selection_extension:
    TargetFilename|endswith:
      - '.json'
      - '.lottie'
      - '.tgs'
  condition: selection_process and selection_extension
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate Telegram sticker/emoji (TGS) rendering which uses Lottie content
level: low

YARA Rule

rule CVE_2026_111105_Lottie_Truncation_Anomaly
{
    meta:
        description = "Heuristic detection for Lottie/JSON animation content with anomalous numeric fields potentially triggering CWE-197 truncation in rlottie (CVE-2026-111105)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-111105"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lottie_a = "\"v\":" ascii
        $lottie_b = "\"layers\":" ascii
        $lottie_c = "\"ip\":" ascii
        $lottie_d = "\"op\":" ascii
        $lottie_e = "\"w\":" ascii
        $lottie_f = "\"h\":" ascii

    condition:
        filesize < 10MB and
        (uint32(0) == 0x4F50454A or $lottie_a) and
        any of ($lottie_b, $lottie_c, $lottie_d) and
        2 of ($lottie_*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-111105 Potential Lottie Animation Delivery to Telegram Client"; flow:established,to_client; http.response_body; content:"application/json"; nocase; content:"\"layers\""; content:"\"op\""; distance:0; within:2048; content:"\"ip\""; distance:0; within:2048; reference:cve,CVE-2026-111105; classtype:attempted-user; sid:2026111105; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

file where process.name : "Telegram.exe" and
  file.extension : ("json", "lottie", "tgs") and
  file.size < 10485760

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR sourcetype=endpoint:process
| search EventCode=1 Image="*\\Telegram.exe" OR (process_name="*Telegram*")
| eval lottie_hit=if(match(_raw, "(?i)\.(json|lottie|tgs)") AND match(_raw, "(?i)(layers|op|ip)"), 1, 0)
| where lottie_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="telegram,cve-2026-111105,">
  <rule id="2026111" level="7">
    <if_sid>59200</if_sid>
    <field name="win.eventdata.image">Telegram\.exe$</field>
    <field name="win.eventdata.targetFilename">\.(json|lottie|tgs)$</field>
    <description>CVE-2026-111105: Telegram process opened Lottie animation file - possible rlottie exploitation attempt</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>attack_exploitation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround is currently available.

1. Immediate mitigations

   • Treat all externally sourced Lottie animation content (.json / .lottie / .tgs) as untrusted; where possible, disable or restrict automatic rendering of external animation content in Telegram.
   • Enforce user-awareness controls against opening unsolicited animation files or visiting unverified pages that render such content.
   • Restrict the privileges of the Telegram process on managed endpoints (least privilege, application control) to limit the impact of in-process code execution.
   • Enable memory-protection mitigations (ASLR, DEP/CFG on Windows; hardened allocators) to raise the attack complexity given the CVSS AC:H rating.
   • Monitor and alert on anomalous Telegram process behavior (crashes, unusual child processes, outbound connections) as a corruption indicator.

2. Patch / upgrade steps

   • No patched version is available from any tracked source. Monitor the vendor (Telegram) and the rlottie upstream project for a security release addressing CWE-197 in the affected component.
   • Track ZDI case ZDI-CAN-30207 and the NVD entry for CVE-2026-111105 for the coordinated disclosure timeline and fix availability.
   • Once a fix is published, upgrade Telegram (and any standalone rlottie consumer) to the fixed release and verify the bundled rlottie component version.

3. Long-term hardening

   • Inventory where rlottie or equivalent animation-parsing libraries are embedded as third-party components and include them in software bill of materials (SBOM) and dependency tracking.
   • Implement input validation and fuzz testing for animation parsers, with a focus on integer-width and signedness handling (CWE-197 class).
   • Adopt runtime exploit mitigations and EDR behavioral monitoring on endpoints running communication clients that render externally supplied content.

References

• NVD — CVE-2026-111105: https://nvd.nist.gov/vuln/detail/CVE-2026-111105
• Trend Micro Zero Day Initiative — case ZDI-CAN-30207 (reference cited in the NVD description)
• CWE-197: Numeric Truncation Error — https://cwe.mitre.org/data/definitions/197.html
• FIRST.org EPSS — CVE-2026-111105 (not yet scored at time of writing): https://api.first.org/data/v1/epss?cve=CVE-2026-111105
• rlottie upstream project (animation-rendering library referenced in the NVD description) — consult the maintainer's repository and release notes for future security fixes

Threat actor campaigns / exploit-in-the-wild evidence: none reported. CVE-2026-111105 is not listed in CISA KEV, no public PoC or exploit code has been identified, and no active exploitation campaigns are documented in the provided intelligence.