Telegram Desktop CVE-2026-7701

User must click a malicious link or interact with a crafted Telegram message containing the specially formatted login_url parameter. The vulnerability is triggered within the Bot API RequestButton function when processing the login_url argument, so the user's Telegram Desktop client must attempt to process this parameter. No authentication is required from the attacker's perspective, and the attack is remotely deliverable via Telegram's messaging infrastructure. The vulnerability exists by default in affected versions without requiring non-standard configuration. Exploitation is limited by the requirement for user interaction-the application crash only occurs if the user clicks the malicious link or if Telegram Desktop automatically processes the parameter in certain message contexts.

This vulnerability presents a moderate real-world risk with several mitigating factors. The CVSS score of 4.3 reflects low severity, driven by the requirement for user interaction (UI:R) and limited impact scope (denial of service only, with no confidentiality or integrity compromise). The CVSS vector shows network attack surface (AV:N/AC:L/PR:N) but mandatory user engagement (UI:R) significantly reduces practical exploit likelihood. EPSS scoring data is not provided, but the public exploit disclosure (E:P) and reliable reproduction (RC:R) suggest the vulnerability is technically feasible. However, the absence of authentication requirements and network vector are offset by the user-interaction prerequisite-an attacker must socially engineer a user to click a crafted link. The impact is limited to availability (denial of service via application crash), not system compromise. The vendor's non-response to early disclosure (per description) raises concern about patch availability but does not elevate the technical severity. This is a legitimate priority for desktop application users but not a critical infrastructure threat; prioritize based on user base exposure and whether user awareness training can mitigate the social engineering vector.

An attacker crafts a malicious Telegram message or web link containing a specially formatted login_url parameter that, when clicked by a user, triggers the RequestButton function in Telegram Desktop. The null pointer dereference in url_auth_box.cpp causes the application to crash, resulting in denial of service for that user. The attacker could distribute this link via Telegram channels, social engineering, or embedding it in web pages to target multiple users, causing widespread application crashes among victims who interact with the link.