Telegram CVE-2024-7014

HIGH

Improper Input Validation (CWE-20)

2024-07-23 security@eset.com

Information Disclosure Google Telegram

7.1

CVSS 4.0 · Vendor: eset

Share

Severity by source

Vendor (eset) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (eset) · only source for this CVE.

CVSS VectorVendor: eset

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

A

Scope

X

Lifecycle Timeline

1

CVE Published

Jul 23, 2024 - 10:15 cve.org

HIGH 7.1

DescriptionCVE.org

EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.

AnalysisAI

EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older. Affected products include: Telegram.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Telegram

View all

CVE-2019-10044 HIGH This Week POC

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to a

CVE-2018-20436 HIGH This Week POC

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests

CVE-2021-31321 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the

CVE-2021-31320 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2022-43363 MEDIUM This Month POC

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. Rated medium severity (C

CVE-2021-30496 MEDIUM This Month POC

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the

CVE-2023-26818 MEDIUM This Month POC

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT

CVE-2021-31323 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2021-31322 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2021-31319 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LO

CVE-2021-31318 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCo

CVE-2021-31317 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDash

Same weakness CWE-20 – Improper Input Validation

View all

CVE-2021-44228 CRITICAL POC

CVE-2024-3400 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2023-22515 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2017-9791 CRITICAL POC

CVE-2017-15944 CRITICAL POC

CVE-2019-0604 CRITICAL POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2024-7014 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy