CVE-2021-31320
📋 TL;DR
A heap buffer overflow vulnerability in Telegram's custom rlottie library allows remote attackers to potentially execute arbitrary code or crash the application via malicious animated stickers. This affects Telegram users on Android, iOS, and macOS who receive or view these stickers. The vulnerability resides in the VGradientCache::generateGradientColorTable function.
💻 Affected Systems
- Telegram Android
- Telegram iOS
- Telegram macOS
📦 What is this software?
Telegram by Telegram
Telegram by Telegram
Telegram by Telegram
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or persistent malware installation.
Likely Case
Application crash (denial of service) or limited memory corruption that could be leveraged for further exploitation.
If Mitigated
No impact if patched versions are used or if animated stickers are disabled/blocked.
🎯 Exploit Status
Exploitation requires user interaction (viewing/receiving sticker) but no authentication. Technical details and PoC are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android 7.1.0 (2090), iOS 7.1, macOS 7.1
Vendor Advisory: https://telegram.org/blog/version-7-1
Restart Required: No
Instructions:
1. Open Telegram app. 2. Go to Settings > About. 3. Check version. 4. If below patched version, update via official app store (Google Play, App Store, Mac App Store).
🔧 Temporary Workarounds
Disable animated stickers
allPrevent rendering of animated stickers that could trigger the vulnerability.
Not applicable - UI configuration only
Block sticker downloads
allUse network filtering to block download of animated sticker files.
Firewall rules to block Telegram sticker CDN domains
🧯 If You Can't Patch
- Disable animated stickers in Telegram settings immediately
- Use web version or desktop clients (not affected) instead of mobile apps
🔍 How to Verify
Check if Vulnerable:
Check Telegram version in app settings: Android <7.1.0 (2090), iOS <7.1, macOS <7.1Check Version:
Not applicable - check via app UI Settings > AboutVerify Fix Applied:
Confirm version is Android ≥7.1.0 (2090), iOS ≥7.1, or macOS ≥7.1📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unexpected process termination
Network Indicators:
- Downloads of animated sticker files (.tgs format) followed by crashes
SIEM Query:
Process:telegram AND (EventID:1000 OR ExceptionCode:c0000005)🔗 References
- https://www.shielder.it/advisories/telegram-rlottie-vgradientcache-generategradientcolortable-heap-buffer-overflow/
- https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/
- https://www.shielder.it/advisories/telegram-rlottie-vgradientcache-generategradientcolortable-heap-buffer-overflow/
- https://www.shielder.it/blog/2021/02/hunting-for-bugs-in-telegrams-animated-stickers-remote-attack-surface/
