Is CVE-2026-107181 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-107181?

CVE-2026-107181 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-107181

Description

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.