CVE-2026-111105High· 7.0▾ Abyssal0dayTelegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerabili…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 38.5 · likelihood 0 · exploitation 25
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the rlottie library. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30207.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107181High· 8.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons
CVE-2026-94488High· 8.2Telegram Desktop before 6.9.4 allows XSS in the HTML exporter
CVE-2026-33795High· 7.5A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a denial of service via a BGP Prefix-SID route advertisement that is …
CVE-2026-102043Medium· 6.5A Numeric Truncation Error vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to crash the routing process via MPLS-TE fast-reroute signaling.
CVE-2026-96995High· 7.8Stack-based buffer overflow in Microsoft Office Word allows an authorized attacker to elevate privileges locally.
CVE-2026-96113Critical· 9.8Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.