Telegram is facing fresh security concerns after researcher Saifeldeen Aziz reported vulnerabilities in the messaging platform’s animated-sticker processing that could potentially allow attackers to execute code on users’ devices, including iPhones.
The findings, presented at OffensiveCon 2026, have raised questions about the effectiveness of Telegram’s server-side security checks. However, the full technical details, affected software versions and conditions required to exploit the reported vulnerabilities remain unclear.
Telegram’s animated stickers contain compressed data that the application processes before displaying them. This process relies on software libraries that interpret animation instructions, potentially creating opportunities for attackers to exploit weaknesses in the rendering mechanism.
According to Aziz’s research, Telegram’s sticker processing contains multiple memory-corruption vulnerabilities, alongside weaknesses in how stickers are delivered and verified.
By combining these issues, the researcher claims to have bypassed Telegram’s server-side checks and achieved code execution in the Telegram application for iOS. The research also examined Android and desktop clients.
A zero-click attack is especially worrisome since the device may be attacked and compromised even without clicking any links or opening files by the user. Unfortunately, the exploit chain in totality has not been proved by any technical documentation yet.
As per the Zero Day Initiative, the vulnerability would enable attackers to run arbitrary code in the vulnerable application. However, the attack can only happen when the user visits a malicious website or opens a malicious file. This is not a zero-click vulnerability. There is no patched version found in the advisory.
The disclosure also triggered a disagreement between Telegram and ZDI over the effectiveness of server-side sticker validation.
On March 31, Telegram said server-side validation had mitigated the vulnerability. ZDI challenged the handling of the case, arguing that requiring a complete remote-code-execution chain was inconsistent with standard coordinated disclosure procedures. The advisory was published on October 15.
Aziz’s latest findings raise further questions about whether weaknesses in sticker delivery and verification could allow attackers to bypass existing protections.
Also Read: Telegram May Launch a Personalized Feed: What Could Change?
Users should update Telegram to the latest available version and avoid suspicious files and unfamiliar links. They can also review the app’s Privacy and Security settings to restrict who can contact them. There is currently no confirmed evidence of widespread exploitation linked to the reported findings.