A high-severity vulnerability in Telegram Desktop can let a malicious link read files from a user’s computer and steal session data that may enable account takeover. The flaw, tracked as CVE-2026-107181, affects versions earlier than 7.2.9 and was described in a public technical disclosure updated on October 7, 2026.
The attack requires the user to click a link and may involve a browser confirmation before Telegram launches. Researchers confirmed the attack path on Windows; Telconet’s security advisory says macOS and Linux exploitation was not confirmed.
How the attack works
Telegram Desktop uses a local socket to pass links from a newly launched process to an already-running instance. According to the researcher’s analysis, the client did not properly escape the semicolon used to separate internal commands. A crafted link could therefore inject additional commands into the message sent over that socket.
The injected commands reached a legacy internal handler that could read specified files and send them to an attacker-controlled Telegram chat. That could include files storing an active Telegram Desktop session. An attacker who reconstructs those files may be able to open the victim’s account without going through a new login flow.
The vulnerability has a CVSS 3.1 score of 8.1 and is classified as high severity. Telconet reported that active exploitation had not been confirmed and that a public proof of concept was available.
Update Telegram Desktop now
- Open Telegram Desktop and check the installed version in the application’s About or Settings area.
- If the version is earlier than 7.2.9, download the client from the official Telegram Desktop site or the project’s GitHub releases page.
- Restart Telegram Desktop after updating, then review Settings and Devices and terminate any session you do not recognize.
Updating is the only mitigation that closes the vulnerability. Until the update is installed, users should avoid unfamiliar links that launch Telegram, particularly links using the tg:// scheme. Enabling a strong local passcode can make stolen session files harder to reuse, but it does not prevent the underlying file theft.
Users should also enable the setting that asks where downloaded files should be saved and restrict who can add them to groups. Those measures reduce exposure but are not substitutes for upgrading.
References
- Telconet CSIRT. (2026, October 11). Vulnerabilidad en Telegram Desktop permite robo de archivos y toma de cuentas. https://csirt.telconet.net/comunicacion/boletines-servicios/vulnerabilidad-en-telegram-desktop-permite-robo-de-archivos-y-toma-de-cuentas/
- BeakSec. (2026, October 7). Telegram Desktop: One-click account takeover via IPC injection. https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
- telegramdesktop/tdesktop. (2026, September 17). Release v7.2.9. GitHub. https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9
- Tenable. (2026, October 7). CVE-2026-107181. https://www.tenable.com/cve/CVE-2026-107181