telegramdesktop vulnerabilities

Products

• telegramdesktop/tdesktop 1

Latest telegramdesktop CVEs

Newest publication first

1. CVE-2026-107181 Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

   Published 2026-10-07

   High·CVSS 8.6 EPSS 0.63%

   Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.