Read the docs
TI-2026-69140 Aliases CVE-2026-107181GHSA-2h6w-ccjh-5jhr

Telegram Desktop IPC Record Injection Enables File Exfiltration

Priority HIGH 72CWE-143Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Telegram Desktop before 7.2.9 contains an IPC record-separator injection flaw in Core::Sandbox, and remote attackers can inject OPEN: records through crafted tg:// links that contain unescaped semicolons. The injected records reach the interpret: scheme handler, which lets an attacker upload local files, including tdata session keys, to an attacker-controlled channel and take over the account. CISA's SSVC rates exploitation as poc and automatable as no, and the vulnerability is not in CISA KEV. The CVSS 4.0 base score is 8.6 (HIGH).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Telegram Desktop (Telegram): 7.2.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TelegramTelegram Desktopbefore 7.2.97.2.9Patch availableCNA
  • Telegram Desktop VendorTelegram Affected before 7.2.9 Fixed in 7.2.9 Patch available CNA

Remediation

Update Telegram Desktop to version 7.2.9 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Telegram Desktop (Telegram) Fixed in 7.2.9

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107181
  2. 2026-10-07 Alias added: GHSA-2h6w-ccjh-5jhr
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: MEDIUM → HIGH

References

Exploit 1

Patch 1

Other 4

  • TI-2026-63443 Cross-site scripting in Telegram Desktop CVSS 4.0HIGH 8.3
  • TI-2018-11088 An issue was discovered in the org.telegram.messenger application 4.8.11 for Android. CVSS 3.0MEDIUM 6.8
  • TI-2021-10892 The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of… CVSS 3.1MEDIUM 5.7
  • TI-2023-11787 Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or… CVSS 3.1MEDIUM 5.5
  • TI-2026-06783 Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference CVSS 4.0MEDIUM 5.3
  • TI-2021-22409 Telegram Desktop 2.9.2 - Denial of Service (PoC) CVSS 4.0MEDIUM 4.6
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences