Pull to refresh
Logo
What Changed
Following Why Sign Up
Telegram Desktop flaw let one crafted link take over an account

Telegram Desktop flaw let one crafted link take over an account

New Capabilities

An unescaped semicolon turned a single click into full account theft; 23 days after the fix, most package channels still ship the vulnerable build.

October 15th, 2026: Write-up listed on Packet Storm

Overview

Updated Oct 30

A single clicked link could empty a Telegram Desktop account. The link slipped hidden commands into the app's local socket, which failed to escape the semicolon separating them. Those commands read files that together unlock the login and sent them to an attacker's chat.

Telegram fixed the bug in version 7.2.9 on September 17, 2026, without a security advisory. On October 12 Telegram told reporters the risk was 'practically nil' because an attacker would need the victim to click and confirm a suspicious link and know the exact file path. A public write-up listed on Packet Storm on October 15 keeps the technical details in circulation. An October 10 audit found 64 of 86 package channels still distributing older builds.

Why it matters

Anyone running Telegram Desktop before 7.2.9 could lose their account to one link, and many Linux builds remain unpatched.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

74%
of package channels still ship the vulnerable build
An October 10 audit of 86 channels that distribute Telegram Desktop found 64 offering builds older than 7.2.9; only 22 ship the fix. Debian marks bookworm and sid vulnerable, and Ubuntu lists bionic, focal and jammy as needs-triage.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

B
beaksec
Independent security researcher who discovered and disclosed the vulnerability
Disclosed the flaw; published the technical writeup October 3, 2026

Organizations Involved

Telegram Messenger LLP
Telegram Messenger LLP
Software company / messaging platform
Fixed the flaw in version 7.2.9 without a security advisory; on October 12 said the risk was practically nil and that updated apps are safe.

The company behind the Telegram messaging app, whose desktop client shipped the vulnerable IPC code.
Zero Day Initiative (ZDI)
Zero Day Initiative (ZDI)
Vulnerability disclosure program run by Trend Micro
Relayed the disclosure and closed it after the vendor patched

Trend Micro's coordinated disclosure program, the channel through which the Telegram flaw was reported.
VulnCheck
VulnCheck
Cyber threat intelligence firm
Assigned CVE-2026-107181

The firm that assigned the CVE identifier and supplied the CVSS 4.0 score.

Timeline

June 2026 October 2026

10 events Latest: October 15th, 2026 · 4 weeks ago
Tap a bar to jump to that date

  1. Write-up listed on Packet Storm

    Latest Disclosure

    Packet Storm published an entry titled 'Telegram Desktop 7.2.8 IPC Injection Account Takeover', credited to Bobur Abdugafforov. It extends public technical coverage of the flaw to a security archive.

  2. Telegram says the risk was practically nil

    Response

    Telegram said the flaw was fixed in mid-September and that updated apps are safe. It argued an attacker would need a user to click and confirm a suspicious link and know the exact file path.

  3. Disclosure reaches broad public attention

    Disclosure

    The writeup and CVE details circulate widely, drawing attention to the silently shipped fix.

  4. Audit finds 64 of 86 package channels still ship vulnerable builds

    Analysis

    A review of 86 channels that distribute Telegram Desktop found 64 still offering builds older than the 7.2.9 fix, 23 days after release. Debian's tracker marks bookworm and sid vulnerable; Ubuntu lists bionic, focal and jammy as needs-triage.

  5. CVE assigned

    Disclosure

    VulnCheck assigns CVE-2026-107181 and rates it 8.1 High under CVSS 3.1 and 8.6 under CVSS 4.0.

  6. Technical writeup published

    Disclosure

    beaksec publishes the full attack chain showing how one clicked link reads session files and hands over the account.

  7. ZDI closes the case

    Disclosure

    ZDI marks the report as already fixed by the vendor and returns disclosure rights to the researcher.

  8. Telegram Desktop 7.2.9 ships

    Release

    The patched version publishes, but the changelog lists only a rendering fix and no security advisory accompanies it.

  9. Telegram patches the bug

    Fix

    Commit db3405699f removes the `interpret:` helper and escapes the semicolon separator in the single-instance socket.

  10. Flaw reported through ZDI

    Disclosure

    An independent researcher reports the IPC injection vulnerability in Telegram Desktop to Trend Micro's program.

Scenarios

1

Unpatched Telegram installs targeted in the wild

Possible Resolves by Apr 10, 2027

Discussed by: CISA's KEV process and threat intel firms such as VulnCheck

Linux and older Windows builds still run vulnerable versions, and the technical writeup is now public. If attackers chain it into campaigns, CISA would add the CVE to its Known Exploited Vulnerabilities catalog, the clearest signal of in-the-wild use. No network indicators were published at disclosure, so exploitation would start from scratch.

2

Researchers find a sibling IPC flaw in another desktop app

Possible Resolves by Oct 10, 2027

Discussed by: Independent security researchers; the pattern is common to single-instance bridges

The unescaped-separator bug is a general design smell in apps that hand links to a running instance over a local socket. The Telegram writeup gives researchers a template to audit similar clients. A new CVE describing the same mechanism in another major app would confirm the pattern is broader than Telegram.

3

Patch adoption lags and accounts stay exposed

Uncertain Resolves by Jan 15, 2027

Discussed by: Tenable's Linux unpatched advisories and silent-update watchers

The fix shipped with no advisory, so many users may not know to update. Tenable already lists CVE-2026-107181 as unpatched on some Linux distributions. If most desktop installs run version 7.2.8 or older well into 2027, the vulnerability remains live even though it is patched upstream.

4

Linux distributions leave users exposed for months

Likely Resolves by End of 2026

Discussed by: Reptile.haus package-repo audit, Debian and Ubuntu security trackers

The October 10 audit found Debian's tracker marks bookworm and sid vulnerable with the fix unfixed, and Ubuntu lists bionic, focal and jammy as needs-triage in universe. Twenty channels are more than three years behind upstream. Until distros ship backported patches, users on those channels run the same one-click account theft the upstream fix closed.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

May 2019

WhatsApp spyware call (2019)

A flaw in WhatsApp's voice-call handling let NSO Group's Pegasus spyware install on a phone with a single call, needing no action from the target beyond accepting it. The bug was tracked as CVE-2019-3568.

Then

WhatsApp urged all users to update and disclosed the bug publicly within days.

Now

The case showed messaging apps as prime entry points for spyware and led to lawsuits against NSO Group.

Why this matters now

Like the Telegram flaw, a single interaction inside a trusted messaging app was enough to compromise a target's device and data.

August 2016

Trident iPhone attack chain (2016)

Three iOS vulnerabilities chained through a malicious link sent in a message installed Pegasus spyware with no user action. Citizen Lab discovered the chain while investigating an activist's phone.

Then

Apple shipped iOS 9.3.5 within days to patch all three flaws.

Now

The discovery publicized commercial zero-day spyware and pushed Apple toward faster emergency patches.

Why this matters now

A single link delivered through a messaging app gave full device compromise, the same one-click threshold the Telegram vulnerability crossed.

Sources

(9)
+3
beaksec ThreatWire CVE Matrix Tenable Threadlinqs DEV Community Reptile Haus Numerama Packet Storm (via Vulners)