CVE-2021-31315

What it actually does

Stack-based buffer overflow in the blit function of the custom rlottie fork permits out-of-bounds read access to stack memory when processing a malicious animated sticker.

Why it matters to the business

Attackers may leak sensitive application memory contents from user devices, creating privacy exposure and potential regulatory or reputational risk for organizations whose employees use the affected messaging clients.

How an attack unfolds

An attacker crafts a malicious animated sticker and delivers it via a Telegram message to a target running an unpatched client; when the victim views the sticker the vulnerable blit routine is invoked, resulting in out-of-bounds stack memory disclosure.

How to fix it

Upgrade Telegram Android to 7.1.0 (2090) or later, iOS to 7.1 or later, and macOS to 7.1 or later. The ktorio/ktor project should be updated to commit e28148d34b87ccd94fb1ef0c21742826619ea444.

How to confirm the fix worked

Confirm client versions meet or exceed the fixed releases above; test rendering of known malicious stickers in a controlled environment and verify absence of out-of-bounds memory access.

Typical attack path

1. Craft malicious animated sticker that triggers stack overflow in rlottie blit function
2. Send sticker to victim via Telegram chat or channel
3. Victim opens or previews the message containing the sticker
4. Client renders the sticker and leaks stack memory contents to attacker-controlled channel

How to detect it

Review application crash logs and memory dumps for rlottie blit function faults coinciding with receipt of animated stickers; correlate message receipt timestamps with any abnormal memory access events.

What your security team should do

• Immediately deploy the fixed Telegram client versions across all managed devices
• Block or filter delivery of animated stickers from untrusted sources until patches are applied
• Monitor crash reports and memory-related telemetry for rlottie anomalies