CVE-2026-107181 — Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// li…
Published: 2026-10-07 · CVSS: 8.6 · CVSS 4.0
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7