CVE-2021-31319: 
NixOS vulnerability analysis and mitigation

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow vulnerability in the LOTGradient::populate function of their custom fork of the rlottie library. The vulnerability was discovered in 2020 and publicly disclosed on February 16, 2021 (Shielder Advisory).

The vulnerability is caused by an integer overflow in the LOTGradient::populate function of Telegram's custom fork of the rlottie library. The CVSS v3.1 base score is 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The issue occurs when processing animated stickers, where a remote attacker could trigger an out-of-bounds read access due to insufficient input validation (NVD, Shielder Blog).

A remote attacker could potentially access heap memory out-of-bounds on a victim's device through a malicious animated sticker. The vulnerability only affects secret chats in Telegram, as regular chats have server-side filtering for stickers (Shielder Blog).

The vulnerability was patched in Telegram Android v7.1.0 (2090), Telegram iOS v7.1, and Telegram macOS v7.1. Telegram also implemented additional security measures to verify that animated stickers in secret chats are part of legitimate sticker sets, preventing the exploitation of this vulnerability (Shielder Blog).