CVE-2026-107181
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Telegram Desktop
CVSS
8.6HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 7 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 7.2.9Telegram DesktopCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Text from CVE List
Affected versions 2
- Telegram Desktopaffected: all versions before 7.2.9CVE List
- Telegram Desktopunaffected: 7.2.9CVE List
References 7
- github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590aFixvia CVE List
- github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9Fixvia CVE List
- vulncheck.com/advisories/telegram-desktop-before-7.2.9-ipc-record-injection-file-exfiltration-via-interpret-schemeAdvisoryvia CVE List
- beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/Exploitvia CVE List
- github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp#L362-L364Referencevia CVE List
- github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp#L673-L751Referencevia CVE List
- github.com/telegramdesktop/tdesktopReferencevia CVE List