Telegram vulnerabilities

Records41All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

Telegram records in CISA KEV

No Telegram vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Telegram 27 records HIGH Telegram Desktop 9 records MEDIUM Telegram Messenger 2 records MEDIUM Web K Alpha 2 records MEDIUM Messenger 1 record LOW Web 1 record LOW

Records

27 records in Telegram · all components

TI-2018-11088 CVE-2018-15543 · GHSA-4cfw-g6m2-82xj

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.

HIGH 65

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.

CVSS 3.0MEDIUM 6.8 Physical No auth No interaction EPSS 0.00428 Published 2018-10-09 No fix listed CWE-287

TI-2021-10892 CVE-2021-30496 · GHSA-25r9-gpg2-xcwf

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of…

MEDIUM 59

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the victim pastes an attacker-supplied message (e.g., in the Persian language) into a channel or group.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01177 Published 2021-04-20 No fix listed CWE-121

TI-2023-11787 CVE-2023-26818 · GHSA-hhv3-mhvj-w7c3

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or…

MEDIUM 58

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00517 Published 2023-05-19 No fix listed CWE-863

TI-2019-07370 CVE-2019-10044 · GHSA-9gmh-43p9-37g6

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android…

MEDIUM 44

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.0328 Published 2019-03-25 No fix listed

TI-2018-14480 CVE-2018-20436 · GHSA-53m8-q7p6-6hq3

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which…

LOW 38

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01554 Published 2018-12-24 No fix listed CWE-918

TI-2024-06509 CVE-2024-7014 · GHSA-6hr2-22jp-cfqq

Improper multimedia file attachment validation in Telegram for Android app

LOW 34

EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.

CVSS 4.0HIGH 7.1 Network Low privileges User interaction EPSS 0.01375 Published 2024-07-23 No fix listed CWE-20

TI-2021-11472 CVE-2021-31320 · GHSA-6hrw-8fx7-cp46

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 34

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.01218 Published 2021-05-18 No fix listed CWE-787

TI-2020-09975 CVE-2020-12474 · GHSA-mf6c-m6cw-6m7x

Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through…

LOW 34

Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02591 Published 2020-05-01 No fix listed

TI-2021-11473 CVE-2021-31321 · GHSA-hqqh-jq4c-g3w3

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 33

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.01101 Published 2021-05-18 No fix listed CWE-787

TI-2023-17366 CVE-2023-34658 · GHSA-6977-5wcp-rwxf

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User…

LOW 30

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00413 Published 2023-06-29 No fix listed CWE-1021

TI-2022-21173 CVE-2022-43363 · GHSA-vjx6-6r3w-rpqc

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation…

LOW 28

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00456 Published 2022-12-06 No fix listed CWE-79

TI-2021-11474 CVE-2021-31322 · GHSA-367c-j2f5-vj73

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 28

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01425 Published 2021-05-18 No fix listed CWE-787

TI-2019-11614 CVE-2019-15514 · GHSA-263v-6w9h-xf97

The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides…

LOW 28

The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that the access level is Nobody, because attackers can find these numbers via the Group Info feature, e.g.,…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.02256 Published 2019-08-23 No fix listed

TI-2018-11087 CVE-2018-15542 · GHSA-qqj6-f5mm-g546

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.

LOW 28

An issue was discovered in the org.telegram.messenger application 4.8.11 for Android.

CVSS 3.0MEDIUM 6.4 Physical No auth No interaction EPSS 0.00343 Published 2018-10-09 No fix listed CWE-287

TI-2021-14890 CVE-2021-36769 · GHSA-phpw-4p8w-67hr

A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for…

LOW 27

A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01385 Published 2021-07-16 No fix listed

TI-2021-11475 CVE-2021-31323 · GHSA-7fqj-v4vw-h2vm

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 27

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01275 Published 2021-05-18 No fix listed CWE-787

TI-2021-11471 CVE-2021-31319 · GHSA-5422-w3xr-rj47

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 27

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01288 Published 2021-05-18 No fix listed CWE-190

TI-2021-11470 CVE-2021-31318 · GHSA-cxmw-4jm5-5gx9

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 27

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01288 Published 2021-05-18 No fix listed CWE-843

TI-2021-11469 CVE-2021-31317 · GHSA-xf3x-92j4-vrpc

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 27

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01288 Published 2021-05-18 No fix listed CWE-843

TI-2021-11467 CVE-2021-31315 · GHSA-85m7-hcp4-g8x4

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected…

LOW 27

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01288 Published 2021-05-18 No fix listed CWE-787

TI-2020-08485 CVE-2020-10570 · GHSA-fwx7-h2cj-c566

The Telegram application through 5.12 for Android, when Show Popup is enabled, might…

LOW 27

The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying.

CVSS 3.1MEDIUM 6.1 Physical No auth No interaction EPSS 0.00389 Published 2020-03-24 No fix listed

TI-2021-08853 CVE-2021-27351 · GHSA-cc4r-2rwj-vx7x

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and…

LOW 26

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00843 Published 2021-02-19 No fix listed CWE-613

TI-2021-08750 CVE-2021-27205 · GHSA-g3fx-gvwr-w892

Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed…

LOW 25

Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive information disclosure.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00297 Published 2021-02-12 No fix listed CWE-312

TI-2021-08749 CVE-2021-27204 · GHSA-3hrw-324r-f9xj

Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.

LOW 25

Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00297 Published 2021-02-12 No fix listed CWE-312

TI-2019-12230 CVE-2019-16248 · GHSA-72jh-q3w2-7xjq

The "delete for" feature in Telegram before 5.11 on Android does not delete shared media…

LOW 25

The "delete for" feature in Telegram before 5.11 on Android does not delete shared media files from the Telegram Images directory.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00439 Published 2019-09-11 No fix listed

Open these records in search →

Critical	2
High	12
Medium	25
Low	2
No CVSS	0