CVE-2026-107181

Name	CVE-2026-107181
Description	Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1150328

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
telegram-desktop (PTS)	bookworm	4.6.5+ds-2	vulnerable
	forky, sid	5.7.2+ds-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
telegram-desktop	source	(unstable)	(unfixed)			1150328

Notes

https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a (v7.2.9)