CVE-2026-107181: Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telegram Desktopto a version that resolves this vulnerability.Fixed in 7.2.9
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to deliver a crafted tg:// link containing unescaped semicolons and have the target interact with it. No attacker privileges are required.
Who is exposed?
Users of Telegram Desktop versions before 7.2.9 are exposed if they can be induced to open a malicious tg:// link.
What is the impact if exploitation succeeds?
The attacker can inject IPC OPEN: records and cause local files to be uploaded to an attacker-controlled channel. This can include tdata session keys, potentially enabling account takeover.
How can I remediate the issue?
Update Telegram Desktop to version 7.2.9 or later. Systems running a version before 7.2.9 should be treated as affected.