Telegram Desktop CVE-2026-7701

Q: What is the CVSS score of CVE-2026-7701?

CVE-2026-7701 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26839 LOW

NULL Pointer Dereference (CWE-476)

2026-05-03 VulDB

Null Pointer Dereference Denial Of Service Desktop

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Severity Changed

May 03, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

May 03, 2026 - 16:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 03, 2026 - 16:15 vuln.today

EUVD ID Assigned

May 03, 2026 - 16:00 euvd

EUVD-2026-26839

Analysis Generated

May 03, 2026 - 16:00 vuln.today

CVE Published

May 03, 2026 - 15:30 nvd

LOW 2.1

DescriptionCVE.org

A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Null pointer dereference in Telegram Desktop up to version 6.7.5 allows remote attackers without authentication to cause denial of service by crafting a malicious login_url argument in the Bot API RequestButton function. The vulnerability requires user interaction to click a malicious link and has a public exploit disclosure, though vendor response to early disclosure notification was not forthcoming.

Technical ContextAI

The vulnerability exists in the RequestButton function within Telegram/SourceFiles/boxes/url_auth_box.cpp of the Telegram Desktop Bot API component. The flaw is a null pointer dereference (CWE-476) triggered when the login_url parameter is manipulated. When a null pointer is dereferenced during request processing, the application crashes rather than gracefully handling the malformed input. This is a memory safety issue where input validation or null-check assertions on the login_url argument are insufficient before dereferencing the pointer in downstream code.

RemediationAI

Users should upgrade Telegram Desktop to a version newer than 6.7.5 as soon as a patched release becomes available; however, no specific fixed version number has been independently confirmed from vendor sources at the time of this analysis. Users should avoid clicking suspicious links, especially those requesting Bot API authorization or login confirmation, as these are the primary attack vector. Until a patch is released, consider disabling automatic link opening in Telegram Desktop settings and enabling manual confirmation for any Bot API authorization requests. Administrators managing Telegram Desktop deployments should monitor vendor announcements for patch releases and enforce upgrades through managed software deployment once patches are confirmed available. The vendor's documented non-responsiveness to early disclosure suggests monitoring community forums and security databases (VulDB, NVD) for patch availability rather than relying on official vendor bulletins.