IPC Record-Separation Injection Vulnerability in Telegram Desktop
CVE-2026-107181

8.6HIGH

Key Information:

Vendor

Telegram

Status
Telegram Desktop
Vendor
CVE Published:
7 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-107181?

Telegram Desktop prior to version 7.2.9 is susceptible to an IPC record-separator injection vulnerability present in Core::Sandbox. This flaw permits remote attackers to craft tg:// links embedded with unescaped semicolons. By exploiting this vulnerability, an attacker can manipulate the interpret: scheme handler to upload local files, such as tdata session keys, to an attacker-controlled channel. This potentially exposes users to account takeover risks, making it essential for users to update to the patched version to mitigate the threat.

Affected Version(s)

Telegram Desktop 0 < 7.2.9

Telegram Desktop 7.2.9

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-107181 - Proof of Concept

References

https://beaksec.github.io/posts/telegram-desktop-one-clic...
technical-descriptionexploit
https://github.com/telegramdesktop/tdesktop/commit/db3405...
patch
https://github.com/telegramdesktop/tdesktop/releases/tag/...
release-notes

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Emiliano Versini
.