EUVD-2026-94329
GHSA-2h6w-ccjh-5jhr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote link delivered to default install (AV:N/AC:L/PR:N) but requires the user to open it (UI:R); session-key theft and account takeover give C:H/I:H, with no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
AnalysisAI
One-click account takeover in Telegram Desktop before 7.2.9, where the Core::Sandbox inter-process communication layer fails to neutralize the semicolon record separator in URLs delivered through tg:// links. An attacker who gets a victim to open a crafted tg:// link can smuggle an extra OPEN: record into the IPC stream; that record is dispatched to the interpret: scheme handler, which uploads attacker-chosen local files - most damagingly the tdata session keys - to an attacker-controlled channel, giving full control of the victim's Telegram account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a crafted tg:// link whose URL contains unescaped semicolons (record separators), which the vulnerable Core::Sandbox IPC in Telegram Desktop versions before 7.2.9 fails to neutralize, allowing injected OPEN: records to reach the interpret: scheme handler and trigger upload of local files such as tdata session keys. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a credible, high-priority issue rather than a high-CVSS paper tiger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 7.2.9 - upgrade Telegram Desktop to 7.2.9 or later on every desktop platform, which is the only complete fix; the release is published at https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9 and the underlying fix is commit db3405699f8fc3ae28d2348b7d13a43c0590a, which percent-escapes semicolons in sandbox records and drops local paths from any connection that also carries an external URL. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Telegram Desktop installations and identify any endpoint running a version below 7.2.9, then prioritize upgrading those systems to 7.2.9 or later; in the interim, instruct users not to open unsolicited tg:// links and consider blocking tg:// protocol handling via endpoint policy where Telegram is not business-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Telegram Desktop
View allTelegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to a
Telegram Desktop before 6.9.4 fails to escape inline-keyboard button text when a chat is exported to HTML, so attacker-c
Telegram Desktop versions up to 2.9.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and applica
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addr
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cle
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechan
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homo
Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop befo
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Da
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today