Telegram Desktop: IPC record injection allows local file exfiltration

Summary

Telegram Desktop before 7.2.9 does not escape the semicolon separator in its local IPC commands. A crafted tg:// link can inject commands that reach the internal interpret: handler, which can upload local files, including Telegram session data (tdata), to an attacker-controlled chat. Exploitation requires that a user clicks a malicious link from outside Telegram, and the attacker may then take over the victim's Telegram account.

Affected

• Telegram Desktop before 7.2.9 (CVE record: 0 to less than 7.2.9)
• The researcher confirmed the issue up to 7.2.8 on Windows (version 6.9.3). macOS and Linux were not demonstrated.

Fixed in

• Telegram Desktop 7.2.9 (patch commit db3405699f8fc3ae28a58d2348b7d13a43c0590a)

Workaround

• No workaround is documented by the vendor. Update to 7.2.9.
• Setting a local passcode in Telegram Desktop limits account takeover but does not prevent file reads.

Exploitation

• Public proof of concept: yes. The researcher published the attack chain and a PoC in October 2026. Not verified for this entry.
• CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'.
• In the wild: no known exploitation.

Our recommendation

• Update Telegram Desktop to 7.2.9 or later on all workstations, including portable installs.
• Inventory all installations and identify versions 7.2.8 and earlier.
• Avoid opening tg:// links from untrusted sources.
• Enable two-step verification and review active sessions after any suspected exposure.
• Prioritise workstations that hold sensitive files and where Telegram Desktop is used for business messaging.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (3 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  SeanDishman/telegram-cve-2026-107181 · 00nx/telegram-account-takeover-poc · abdugafforov-bobur/cve-2026-107181-poc

Research sources

• VulnCheck advisory www.vulncheck.com
• Telegram Desktop release v7.2.9 github.com
• Patch commit db3405699f8fc3ae28a58d2348b7d13a43c0590a github.com
• beaksec write-up beaksec.github.io
• OSV entry CVE-2026-107181 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:14.