A numeric truncation flaw in the rlottie library used by Telegram allows attackers to write data before the beginning of an allocated buffer, leading to arbitrary code execution in the context of the Telegram process. The vulnerability requires the victim to interact with malicious content, such as visiting a malicious page or opening a malicious file, after which the attacker’s code can run with the permissions of the Telegram client.

The flaw impacts Telegram clients that integrate the rlottie animation engine. No specific product versions are listed, so any installation using the affected library is potentially vulnerable.

The CVSS score of 7 indicates high severity, yet the EPSS score is currently unavailable and the issue is not listed in CISA KEV. Exploitation requires user interaction, meaning that the attacker must convince or trick a user to open a crafted link or file. Once the interaction occurs, the attacker can execute arbitrary code with the process’s privileges. Given the lack of a publicly known exploit, the immediate risk is mitigated by applying a patch, but the high severity and remote execution potential warrant prompt action.