Vulnerability in Telegram Desktop before 7.2.9: CVE-2026-107181, 8.6 on CVSS

A high-severity vulnerability was found in Telegram Desktop before version 7.2.9. It was assigned the identifier CVE-2026-107181 and a score of 8.6 on CVSS 4.0. VulnCheck published the advisory about it on October 7, 2026.

The problem lies in the Core::Sandbox module and belongs to class CWE-143, improper neutralization of record delimiters. The IPC record separator was not escaped, so a crafted tg:// link containing a semicolon could slip extra commands to the service handler, including OPEN: records, and bypass the client's expected logic.

A click on such a link went through the interpret: handler. With its help, an attacker could send files from the computer to their channel, among them tdata session keys. According to the advisory description, this opens a path to account takeover.

By the CVSS vector, the attack is remote and requires the action of a user who opens the link. The highest scores are for the consequences to confidentiality and integrity (VC:H and VI:H); the impact on availability is zero (VA:N). All Telegram Desktop builds from 0 to 7.2.9 are vulnerable.

The finder named in the advisory is Emiliano Versini. The fix was included in version 7.2.9. The advisory contains links to an analysis titled Telegram Desktop one-click account takeover and to the patch commit.

Image:

Translation editors: Соловьев В., Пеков А.