TL;DR: An independent researcher published full details on October 3 of a vulnerability in Telegram Desktop through version 7.2.8 that turned a single clicked link into a session-file exfiltration. The chain combined an unescaped separator in the desktop client's local-socket IPC with an internal URI scheme that reads local files and ships them to a chat. Telegram fixed the bug in commit db3405699f on September 16, 2026, and shipped version 7.2.9 the next morning. The release notes mention only a rendering fix. CVE-2026-107181 was assigned on October 7 with a CVSS 3.1 base score of 8.1. Anyone running Telegram Desktop on Windows and not yet on 7.2.9 should update now [1][2].
The Flaw: One Click Hands Over The Account
The vulnerability affects Telegram Desktop through 7.2.8 on Windows. It was confirmed on Windows 6.9.3 by the reporting researcher, who publishes as beaksec, and disclosed in a full technical writeup on October 3, 2026 [1].
The chain needs three things: the victim has to be added to a Telegram group they did not ask to join, a file the group is auto-downloaded has to land at a predictable path, and the victim has to click one innocuous-looking link posted in that group. From there, the desktop client reads the targeted files off the user's own disk and ships them to an attacker-controlled chat. The reporter summarizes the consequence in one sentence: "Someone adds you to a Telegram group. A link shows up in the chat. You click it, and your Telegram account is no longer only yours." That sentence appears in the public writeup [1].
The stolen files are the three parts of a Telegram Desktop session: key_datas, the file D877F783D5D3EF8Cs, and that file's maps sibling, all under the tdata directory. The folder name D877F783D5D3EF8C "is derived from the string data, the default data name," and "is identical on every install," per the writeup. Drop the three files into a fresh tdata, open Telegram, and the attacker's copy logs into the victim's account [1].
No confirmation dialog is shown at any point. The writeup states directly that "No confirmation dialog is shown" during the attack sequence [1].
How The Exploit Chains Two Bugs Together
The desktop client uses a single-instance design. If Telegram is already running and the user clicks an external link, the OS launches a second Telegram process that opens a local socket to the running instance and hands off the link. The writeup shows the design: "Telegram Desktop hands clicked links to its own already-running instance over a local socket, as text, and never escapes the character it uses to separate commands." The format Telegram picked is one instruction per line, terminated by a semicolon [1].
Bug one is in that serialization. The launching process treats the URL as a string and writes it into the socket without escaping the semicolon inside the URL itself. A crafted tg:// link containing ; therefore arrives at the running instance as several instructions, not one. The writeup spells out the parsing side: "The running instance cuts at every semicolon and gets two instructions instead of one" [1]. The running instance accepts four commands, and per the writeup three of them are harmless: CMD:, for example, only accepts show or quit. The fourth, OPEN:, accepts any URL, with no filter on the scheme [1].
Bug two lives inside the OPEN: path. Telegram used to ship its own release announcements through an internal URI scheme called interpret:. The build scripts wrote a small text file naming a channel, a file to send, and a caption, then launched Telegram with the path of that file. The file invoked Support::InterpretSendPath, which read the named file off disk and sent it to the named chat. The from: field in the instruction file is supposed to gate who can run the action. The writeup reports that the value of from: "is compared against the id of the currently logged-in account" but is not required. Omitting it works. The function "performs no authorization check" and never asks the user to confirm [1].
The full proof of concept is three text files posted into a group the victim has been added to, each naming one of the three session files and the attacker's own chat as the destination. Telegram resolves interpret: paths relative to its own working directory under %APPDATA%\Telegram Desktop, so a path like ../../../Downloads/Telegram%20Desktop/instructions.txt lands at a deterministic location without needing the Windows user name. The attacker then posts an innocuous https:// link in the same group. Clicking it opens a tab that 302-redirects to tg://x?a=1;OPEN:interpret:...instructions1.txt;OPEN:interpret:...instructions2.txt;OPEN:interpret:...instructions3.txt. The launcher's serialization turns the single URL into three OPEN: commands. The desktop client executes them, reads the three tdata files, and posts them into the attacker's group [1].
CVE-2026-107181 was assigned on October 7, 2026. The writeup lists the CVSS 3.1 vector as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, scoring 8.1 (High). The researcher reported the bug through the Zero Day Initiative on June 25, 2026; Telegram shipped the fix independently on September 16, 2026 [1].
The Patch Shipped In 7.2.9 Quietly
Telegram merged fix commit db3405699f "Remove legacy interpret path helper." on September 16, 2026. The release version 7.2.9 followed the next morning [2].
Per the writeup, the fix removes the interpret:// scheme and Support::InterpretSendPath entirely and escapes the record separator on the single-instance socket; local file paths are also dropped once a non-local URL has appeared on the same connection [1]. The commit, made under the john-preston account, changes 11 files [2].
None of this was announced. The 7.2.9 changelog on the desktop update channel mentions only a rendering fix. The closing commit is titled "Remove legacy interpret path helper," and no advisory accompanied the release. The writeup calls out the gap: "The fix shipped quietly: the 7.2.9 changelog mentions only a rendering fix, the commit that closes the chain is titled 'Remove legacy interpret path helper,' and no advisory accompanied it." Most users upgrading through auto-update never learned what the new version protected them against [1].
What To Do Before You Update
The fastest path to safety is the latest Telegram Desktop release. The fixed build, 7.2.9, was published September 17, 2026; anything later includes the patch. [1]
For anyone who cannot update right now, the writeup identifies a stopgap it calls "the most effective mitigation short of upgrading": turn on the "ask where to save each file" preference. Doing so prevents the auto-downloaded instruction files from ever landing on disk, which means the interpret: handler has nothing to point at. Two smaller settings reduce blast radius without closing the bug. Limiting who can add the account to groups to contacts only makes it harder for an attacker to reach a victim, and a strong local passcode does not stop the theft but makes a stolen session unusable. None of these stop the bug; only updating does [1].
What To Watch
A public Telegram advisory or out-of-band changelog entry. Telegram has not retroactively added a security note to the 7.2.9 release page. Watch for either an updated changelog or a Telegram blog post acknowledging the flaw, which would set the disclosure norm for the next round of desktop-client bugs [1][2].
A first in-the-wild exploitation report. The vulnerability was disclosed by a single independent researcher through a coordinated disclosure channel after the fix shipped. Watch for the first public threat-intel report of a Telegram Desktop session-theft in the wild, which would tell defenders whether the 17 days between commit and public disclosure were quiet [1].
Independent confirmation on macOS and Linux. The writeup confirms the exploit on Windows 6.9.3. Watch for a second researcher to test the chain on macOS or Linux [1].