Cybersecurity News: PoC Released for Telegram Desktop Flaw Enabling Account Takeover
A public PoC targets CVE-2026-107181, a Telegram Desktop IPC injection flaw before 7.2.9. A crafted link opened outside the app can leak local files, including session keys, and lead to account takeover. Update to 7.2.9 now.
Cybersecurity News reports that a public proof of concept is now available for CVE-2026-107181, a Telegram Desktop flaw that can let an attacker steal local files, including session data, after a victim opens a crafted link.
The bug sits in how Telegram Desktop passes links between instances over local inter-process communication (IPC). According to the CVE record from VulnCheck, versions before 7.2.9 did not escape the record separator in that channel, so a crafted tg:// link could inject an extra command. That command reached a legacy internal helper that could upload local files, including the tdata session keys, to an attacker's channel. With those keys, an attacker can take over the account. The record rates it 8.6 (High) under CVSS 4.0 and 8.1 under CVSS 3.1.
Researcher Beaksec published the technical write-up and PoC. Per Cybersecurity News, the chain was demonstrated on Windows, from version 6.9.3 through 7.2.8. It was not shown on macOS or Linux. The "one-click" label comes with caveats. The link must be opened outside Telegram, such as from a browser. The demonstrated chain also relies on automatic file downloads in groups and on privacy settings that let anyone add the victim to a group. A local passcode protects the session data.
Telegram fixed the issue in commit db3405699f on September 16, which removes the legacy helper, and shipped version 7.2.9 on September 17. The release notes only mention a rendering fix. Per Cybersecurity News, as of October 9 there was no known exploitation in the wild and no CISA KEV listing.
What to do:
- Update every Telegram Desktop install to 7.2.9 or later.
- Set a local passcode in Privacy and Security.
- Turn off automatic file downloads, and limit who can add you to groups.
- Be wary of unexpected browser prompts to open Telegram.
- If you suspect exposure, end other active sessions and check your chats for files you did not upload.
Sources: Cybersecurity News, the CVE-2026-107181 record, the VulnCheck advisory, Beaksec's write-up, the patch commit, and the 7.2.9 release.
