CVE-2021-31315: 
NixOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability was discovered in Telegram's custom fork of the rlottie library, affecting Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1. The vulnerability (CVE-2021-31315) was identified in the blit function, where a remote attacker could potentially access Telegram's stack memory out-of-bounds on a victim device through a malicious animated sticker (Shielder Advisory).

The vulnerability occurs in the blit function where bound checks are insufficient against negative indices. When spans->x is negative, an out-of-bounds read access is triggered during the std::max call, where the address of ptr is calculated using the negative span->x value. The vulnerability has a CVSS v3.1 score of 5.5 (Medium) (NVD).

An attacker could potentially access Telegram's stack memory out-of-bounds on a victim device. The vulnerability only triggers when a chat containing the malicious animated sticker is opened, making it a persistent threat that could prevent users from accessing previous messages in the affected chat (Shielder Blog).

The vulnerability can be exploited through malicious animated stickers sent via secret chats in Telegram. The attack requires user interaction as the sticker is only parsed and rendered when the chat is opened. The vulnerability was more impactful in secret chats where automatic chat acceptance was possible before Telegram introduced additional security measures (Shielder Blog).

The vulnerability was patched in Telegram Android v7.1.0 (2090), Telegram iOS v7.1, and Telegram macOS v7.1. Telegram also implemented additional security measures requiring animated stickers in secret chats to be part of verified sticker sets, preventing arbitrary sticker parsing (Shielder Advisory).