CVE-2021-31317: telegram Type Confusion

Vulnerability summary

CVE-2021-31317 is a medium (CVSS 5.5) Type Confusion vulnerability in telegram. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 69.7% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 18-05-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.

• CWE-843Access of Resource Using Incompatible Type ('Type Confusion')The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.