Skip to main content

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-31318

Medium
4.3/10

Summary

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.

  • MEDIUM
  • NETWORK
  • NONE
  • NONE
  • PARTIAL
  • NONE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References

Advisory Timeline

  • Published