PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107181 Telegram CVE debrief

CVE-2026-107181 debrief: Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme. This CVE record describes a vulnerability in Telegram Desktop before version 7.2.9, where an IPC record-separator injection vulnerability in Core::Sandbox allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.

Vendor
Telegram
Product
Telegram Desktop
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-07
Original CVE updated
2026-10-07
Advisory published
2026-10-07
Advisory updated
2026-10-07

Who should care

System administrators and users of Telegram Desktop should assess their exposure and verify the version of Telegram Desktop in use. Defenders should prioritize updating Telegram Desktop to version 7.2.9 or later to prevent potential account takeovers.

Why it matters

CVE-2026-107181 is a high-severity vulnerability in Telegram Desktop before version 7.2.9, allowing remote attackers to inject OPEN: records via crafted tg:// links, potentially leading to account takeover. Defenders should prioritize updating Telegram Desktop and verifying the version in use.

  • Account takeover via uploaded tdata session keys
  • Potential data exfiltration through crafted tg:// links
  • Defensive priority for updating Telegram Desktop
  • Verification of Telegram Desktop version in use

Technical summary

The vulnerability is caused by an IPC record-separator injection vulnerability in Core::Sandbox, which allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. This can be used to upload local files, including tdata session keys, to an attacker channel, enabling account takeover. The affected product is Telegram Desktop before version 7.2.9. Defenders should prioritize updating Telegram Desktop and verifying the version in use to prevent potential account takeovers. System administrators and users of Telegram Desktop should assess their exposure.

Defensive priority

Defenders should prioritize updating Telegram Desktop to version 7.2.9 or later to prevent potential account takeovers. System administrators and users of Telegram Desktop should assess their exposure and verify the version of Telegram Desktop in use.

Recommended defensive actions

  • Update Telegram Desktop to version 7.2.9 or later
  • Verify the version of Telegram Desktop in use and assess exposure
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and patches. However, there is limited information on potential exploitation or victim impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107181 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107181

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107181 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107181

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/107xxx/CVE-2026-107181.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/

    Supplemental source - technical-description, exploit

  • Source reference

    Unverified legacy reference

    URL: https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/telegramdesktop/tdesktop

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/telegram-desktop-before-7.2.9-ipc-record-injection-file-exfiltration-via-interpret-scheme

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.