CVE-2026-107181 in Telegram
Summary
by MITRE • 10/07/2026
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Telegram Desktop versions prior to 7.2.9 represents a critical inter-process communication flaw rooted in improper input validation within the Core::Sandbox component. This specific issue is classified under CWE-74 as Improper Neutralization of Special Elements used in an OS Command, often referred to as injection. The core technical failure lies in the handling of Uniform Resource Locators that utilize the tg:// scheme. When a user interacts with a maliciously crafted link containing unescaped semicolons, the application fails to properly sanitize these special characters before passing them to internal handlers. This lack of neutralization allows an attacker to manipulate the structure of IPC records by injecting OPEN: commands directly into the processing stream. The presence of semicolons in this context is particularly dangerous because they often serve as command separators or record delimiters within the application's internal protocol, and their unescaped inclusion disrupts the expected parsing logic.
The operational impact of this vulnerability extends far beyond simple data leakage or cross-site scripting equivalents; it facilitates a severe account takeover scenario through file exfiltration. By exploiting the injection flaw, an attacker can redirect the interpret: scheme handler to execute unintended actions, specifically uploading local files from the victim's machine to a remote channel controlled by the adversary. The most critical target for such exploitation is the tdata session keys stored locally on the user's device. These keys are essential for maintaining authenticated sessions with Telegram servers and effectively act as passwords that allow access without requiring two-factor authentication codes or password resets in many contexts. Once these files are uploaded, the attacker gains persistent control over the victim's account, enabling them to read private messages, impersonate the user, and potentially compromise contacts within the network.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it involves manipulating internal command structures through crafted inputs. It also relates to T1048 Exchange Channel Encryption for Eavesdropping or Manipulation if viewed in the context of intercepting or altering communication flows, though more accurately it fits T1005 Data from Local System due to the direct extraction of sensitive session data. The attack vector is primarily remote via social engineering, requiring the victim to click a malicious link, which classifies this under initial access vectors commonly seen in targeted phishing campaigns.
Mitigation for this vulnerability requires immediate updates to Telegram Desktop version 7.2.9 or later, where the input validation logic has been hardened to properly escape or reject special characters like semicolons within tg:// links. Security teams should enforce strict application whitelisting and monitor for unusual outbound file transfer activities from desktop applications, particularly those involving session files. Users must be educated on the risks of clicking unverified links, as this vulnerability relies heavily on user interaction to trigger the IPC injection. Additionally, implementing network segmentation and monitoring tools that can detect anomalous data exfiltration patterns may help in identifying compromised endpoints where such exploits have been successfully executed prior to patch deployment.