CVE-2026-107181

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 7.2.9

Description An IPC record-separator injection flaw exists in Core::Sandbox due to the failure to escape semicolons used as command separators when passing tg:// links to a running instance over a local socket. A remote attacker can use crafted links containing unescaped semicolons to inject additional commands, specifically targeting the interpret: scheme handler. This handler, a legacy internal helper, allows the unauthorized reading and uploading of arbitrary local files—including tdata session keys, browser sessions, SSH keys, and cryptocurrency wallets—to an attacker-controlled channel without user confirmation. If no local passcode is configured, the theft of session files can lead to full account takeover. The attack is confirmed on Windows and typically requires the victim to click a malicious external link while Telegram is already running.

Recommendations Update Telegram Desktop to version 7.2.9 or later. Enable a local passcode to encrypt session files in the tdata directory. Configure the application to ask where to save each received file. Restrict group invitations to contacts only to minimize exposure to malicious links.