CVE-2021-31317: 
NixOS vulnerability analysis and mitigation

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion vulnerability in the VDasher constructor of their custom fork of the rlottie library. The vulnerability was discovered in 2020 and publicly disclosed on May 18, 2021 (NVD, Shielder).

The vulnerability exists in Telegram's custom fork of rlottie library used for rendering animated stickers. The issue occurs in the VDasher constructor where the code assumes there are at least two dash properties (length and gap). When there's only one dash property, the other property is read out-of-bounds. The vulnerability has a CVSS v3.1 score of 5.5 (Medium) (NVD).

A remote attacker could potentially access Telegram's heap memory out-of-bounds on a victim's device through a malicious animated sticker. The vulnerability is particularly impactful in secret chats where sticker filtering is not performed (Shielder).

The vulnerability can be triggered remotely by sending a specially crafted animated sticker to a victim through Telegram's secret chat feature. The malicious sticker is only processed when the chat is opened, requiring user interaction. The issue persists each time the chat is accessed (Shielder).

The vulnerability was patched in Telegram Android v7.1.0 (2090), iOS v7.1, and macOS v7.1 released in September/October 2020. The fix includes verification checks to ensure animated stickers in secret chats are part of legitimate sticker sets, preventing the processing of malicious stickers (Shielder).