Telegram Desktop
Monthly
One-click account takeover in Telegram Desktop before 7.2.9, where the Core::Sandbox inter-process communication layer fails to neutralize the semicolon record separator in URLs delivered through tg:// links. An attacker who gets a victim to open a crafted tg:// link can smuggle an extra OPEN: record into the IPC stream; that record is dispatched to the interpret: scheme handler, which uploads attacker-chosen local files - most damagingly the tdata session keys - to an attacker-controlled channel, giving full control of the victim's Telegram account. The issue is unauthenticated and needs no non-default configuration (CVSS PR:N, default install); the sole prerequisite is passive user interaction, namely opening the attacker-supplied link, and publicly available exploit code exists. CISA KEV does not list this issue as confirmed actively exploited.
Telegram Desktop before 6.9.4 fails to escape inline-keyboard button text when a chat is exported to HTML, so attacker-controlled button captions are written verbatim into the generated file and execute as script when the victim opens that HTML in a browser. Exploitation is tightly gated: the victim must have used the HTML export feature, must have an attacker-crafted message forwarded into a group they belong to (the original author does not need to be a group member), and must then open the resulting HTML file locally. Publicly available exploit code exists (an expatch.com writeup), but there is no confirmed active exploitation (not in CISA KEV); the vendor scores it 8.3 High under CVSS 4.0, while an independent reassessment places it lower as a user-interaction-gated, scope-changed XSS with limited confidentiality and integrity impact (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Telegram Desktop versions up to 2.9.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard filesystem operations. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
One-click account takeover in Telegram Desktop before 7.2.9, where the Core::Sandbox inter-process communication layer fails to neutralize the semicolon record separator in URLs delivered through tg:// links. An attacker who gets a victim to open a crafted tg:// link can smuggle an extra OPEN: record into the IPC stream; that record is dispatched to the interpret: scheme handler, which uploads attacker-chosen local files - most damagingly the tdata session keys - to an attacker-controlled channel, giving full control of the victim's Telegram account. The issue is unauthenticated and needs no non-default configuration (CVSS PR:N, default install); the sole prerequisite is passive user interaction, namely opening the attacker-supplied link, and publicly available exploit code exists. CISA KEV does not list this issue as confirmed actively exploited.
Telegram Desktop before 6.9.4 fails to escape inline-keyboard button text when a chat is exported to HTML, so attacker-controlled button captions are written verbatim into the generated file and execute as script when the victim opens that HTML in a browser. Exploitation is tightly gated: the victim must have used the HTML export feature, must have an attacker-crafted message forwarded into a group they belong to (the original author does not need to be a group member), and must then open the resulting HTML file locally. Publicly available exploit code exists (an expatch.com writeup), but there is no confirmed active exploitation (not in CISA KEV); the vendor scores it 8.3 High under CVSS 4.0, while an independent reassessment places it lower as a user-interaction-gated, scope-changed XSS with limited confidentiality and integrity impact (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Telegram Desktop versions up to 2.9.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.4.3 does not require passcode entry upon pushing the Export key within the Export Telegram Data wizard. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homograph attack via Punycode in a public URL or a group chat invitation URL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cleartext over the SOCKS5 protocol. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard filesystem operations. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.