CVE-2026-107181Telegram Desktop Vulnerability
Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Published Oct 7, 2026 · Updated Oct 9, 2026 · Also known as EUVD-2026-94329, GHSA-2h6w-ccjh-5jhr
Key Facts
Patch immediately- CVE-2026-107181 is a high-severity vulnerability (CVSS 8.6 v4) affecting Telegram Desktop.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 0.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including pkg:github/telegramdesktop/tdesktop 7.2.9, Telegram Desktop 7.2.9.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v4
8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
0.3%
Higher than 26.5% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
50/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
4
Proof-of-concept links
In-the-wild evidence
1
Reports of active use
Advisories And Exploit References
Description
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Affected Products
8 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Telegram DesktopTelegram | See advisory | 7.2.9 |
Patched Releases
pkg:github/telegramdesktop/tdesktop
7.2.9
Telegram Desktop
7.2.9
Timeline
Publicly disclosed
Oct 7, 2026
Last updated
Oct 9, 2026
Weakness Type
- CWE-143 Improper Neutralization of Record Delimiters
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-107181
- advisoryVulnCheck Advisory: Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
- patchPatch Commit
- exploitTelegram Desktop one-click account takeover write-up
FAQ
Common Questions.
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons.
Affected: Telegram Desktop. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including pkg:github/telegramdesktop/tdesktop 7.2.9, Telegram Desktop 7.2.9.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-107181 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo