CVE-2026-107181

Executive Summary

CVE-2026-107181 is an IPC record-separator injection vulnerability in the Core::Sandbox component of Telegram Desktop versions prior to 7.2.9. A remote attacker can craft a tg:// link containing unescaped semicolons to inject malicious OPEN: records into the inter-process communication stream, which the application then processes. Successful exploitation allows the attacker to reach the interpret: scheme handler, causing the victim's client to upload local files — including tdata session keys — to an attacker-controlled channel, enabling full account takeover without requiring authentication or user credentials beyond a single link click.

Technical Analysis

The vulnerability resides in the inter-process communication (IPC) layer of Telegram Desktop, specifically within the Core::Sandbox component. Telegram Desktop uses an IPC mechanism that serializes commands using record separators; records such as OPEN: are used to instruct the client to handle protocol actions. The flaw is classified as CWE-143 (Improper Neutralization of Record Delimiters), meaning that user-supplied data is not sanitized for record separator characters — in this case, the semicolon (;).

When a user clicks a crafted tg:// URI, the link contents are passed into the IPC pipeline. Because semicolons are not escaped or neutralized, an attacker can break out of the intended record context and inject additional OPEN: records. This allows the attacker to reach the interpret: scheme handler — a handler designed to process local resource references — and abuse it to reference and upload local files. The most sensitive target is the tdata directory, which stores Telegram session keys and authentication material.

Key technical points derivable from the description:

• Attack vector: Network (remote), delivered via crafted tg:// links.
• Attack complexity: Low — no special conditions required beyond user interaction.
• Privileges required: None.
• User interaction: Required (victim must click the crafted link).
• Scope: Unchanged (the vulnerable component impacts resources within its own security authority).
• Confidentiality impact: High — session keys and arbitrary local files can be exfiltrated.
• Integrity impact: High — attacker gains control of the victim's Telegram account.
• Availability impact: None per the CVSS vector.

The root cause is improper input validation/neutralization in the IPC serialization layer. The Core::Sandbox component fails to escape record delimiters before parsing, allowing record injection. This is analogous to injection flaws in other serialization formats (e.g., CSV injection, log injection, or HTTP header injection) where a delimiter character in untrusted data alters the structure of a downstream parser.

No public proof-of-concept, exploit code, or Nuclei template is currently available, and the vulnerability is unpatched according to tracked sources, making proactive mitigation and detection critical.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (IPC record-separator injection) and the NVD description. Only the identifiers explicitly present in the description (tg://, OPEN:, interpret:, Core::Sandbox, tdata) are used.

1) Reconnaissance / Target Identification The attacker identifies a target running Telegram Desktop before version 7.2.9. Delivery is typically via social engineering — the attacker sends the malicious tg:// link through Telegram itself, email, a website, or another messaging platform. The attacker also prepares an attacker-controlled channel to receive the exfiltrated files.

2) Triggering the Flaw The victim clicks the crafted tg:// link. The URI contains unescaped semicolons that break out of the intended IPC record boundary. When Telegram Desktop's Core::Sandbox parses the link data, it fails to neutralize the semicolon record separator, and the attacker's injected OPEN: records are interpreted as legitimate IPC commands.

3) Payload / Execution at the Vulnerability-Class Level The injected OPEN: records drive the client to invoke the interpret: scheme handler. Because the handler does not sufficiently restrict the targets it can act upon, it is abused to reference local files — most critically the tdata session key files. The client then uploads those files to the attacker-controlled channel. No code execution on the host is required; the abuse is purely through the application's own file-handling and upload functionality.

4) Post-Exploitation Impact With the tdata session keys in hand, the attacker can reconstruct the victim's Telegram session or otherwise impersonate them, achieving account takeover. Depending on the files reachable through the interpret: handler, broader local file exfiltration may also be possible. The compromise is silent from the user's perspective — no prompt or credential entry is needed.

Impact Assessment

CVE-2026-107181 has a CVSS v3.1 base score of 8.1 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

• Confidentiality (High): Session keys and other local files can be exfiltrated.
• Integrity (High): Full account takeover enables the attacker to send messages, modify settings, and act as the victim.
• Availability (None): The vector does not indicate availability impact.

Affected systems are any installation of Telegram Desktop before 7.2.9 on Windows, macOS, or Linux. The blast radius includes individual users and — in organizations where Telegram Desktop is used for business communications — potentially sensitive internal conversations, files, and linked accounts. Because the attack requires only a single link click and no privileges, it is highly suitable for targeted phishing campaigns against journalists, executives, activists, and security personnel.

Given that the vulnerability is unpatched per tracked sources, the risk remains elevated until a fixed client is released. There is no CISA KEV listing at this time and no confirmed in-the-wild exploitation evidence.

Detection Guidance

Sigma Rule

title: Telegram Desktop IPC Record-Separator Injection via Crafted tg:// Link
id: 7f3c9a21-6d4e-4b8a-9c2f-1a2b3c4d5e6f
status: experimental
description: Detects execution of Telegram Desktop with tg:// URI arguments containing semicolons and interpret/OPEN record indicators, consistent with CVE-2026-107181 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107181
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\Telegram.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'tg://'
      - ';'
      - 'OPEN:'
      - 'interpret:'
  condition: selection_img and selection_cmdline
fields:
  - CommandLine
  - Image
  - ParentImage
  - User
falsepositives:
  - Legitimate tg:// links that contain semicolons in parameters (rare)
level: high

YARA Rule

rule CVE_2026_107181_Telegram_IPC_Injection
{
    meta:
        description = "Detects crafted tg:// URI strings with unescaped semicolons and injected OPEN:/interpret: records targeting Telegram Desktop Core::Sandbox (CVE-2026-107181)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107181"
        severity = "high"

    strings:
        $tg     = "tg://" ascii wide nocase
        $open   = "OPEN:" ascii wide
        $interp = "interpret:" ascii wide
        $tdata  = "tdata" ascii wide nocase
        $semi   = ";" ascii wide

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        or (
            $tg and $semi and ( $open or $interp )
        )
        or (
            $tg and $interp and $tdata
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107181 Telegram Desktop tg:// IPC Record-Separator Injection Attempt"; flow:to_client,established; content:"tg://"; nocase; content:"interpret:"; nocase; content:";"; within:256; reference:cve,2026-107181; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-107181; classtype:attempted-user; sid:2026107181; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name : "Telegram.exe" and
  process.command_line : "*tg://*" and
  process.command_line : "*;*" and
  (process.command_line : "*OPEN:*" or process.command_line : "*interpret:*")

Splunk SPL Query

index=endpoint sourcetype=WinEventLog:Security OR sourcetype=sysmon EventCode=1
| search Image="*\\Telegram.exe" AND CommandLine="*tg://*"
| search CommandLine="*;*"
| search CommandLine="*OPEN:*" OR CommandLine="*interpret:*"
| table _time, host, User, ParentImage, Image, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="telegram,cve-2026-107181,">
  <rule id="107181" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">Telegram\.exe$</field>
    <field name="win.eventdata.commandLine">tg://</field>
    <field name="win.eventdata.commandLine">;</field>
    <field name="win.eventdata.commandLine">interpret:</field>
    <description>CVE-2026-107181: Possible Telegram Desktop IPC record-separator injection via crafted tg:// link (interpret: handler abuse).</description>
    <mitre>
      <id>T1204.001</id>
    </mitre>
    <group>attack,exploit_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Treat tg:// links from untrusted sources as hostile. Advise users not to click tg:// links received via chat, email, or social media from unknown or unverified senders.
• Where feasible, block or intercept tg:// protocol handler registration at the OS level in high-risk environments until a fixed build is deployed.
• Restrict outbound uploads from endpoints that run Telegram Desktop and monitor for unexpected file uploads from client processes.
• Consider temporarily restricting Telegram Desktop use for personnel who handle sensitive communications, or isolate it on dedicated, low-privilege endpoints.

2) Patch / upgrade steps

• No vendor-verified patch reference is currently available from tracked sources. Monitor Telegram Desktop's official release channels for version 7.2.9 or later and upgrade immediately upon availability.
• Re-image or rotate credentials/sessions for any endpoint suspected of compromise, and revoke active Telegram sessions via the account's session management settings.

3) Long-term hardening

• Enforce application allowlisting and version control for all messaging clients across managed endpoints.
• Deploy URL/protocol handler policies that surface and log invocations of custom schemes such as tg://.
• Adopt least-privilege endpoint configurations to limit the files reachable by desktop applications.
• Maintain a rapid patch pipeline for communication clients and educate users on link-based social engineering.

References

• NVD — CVE-2026-107181: https://nvd.nist.gov/vuln/detail/CVE-2026-107181
• CWE-143 — Improper Neutralization of Record Delimiters: https://cwe.mitre.org/data/definitions/143.html
• FIRST EPSS — not yet scored for this CVE (no value available at time of writing)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-107181 not listed as of this report
• Telegram Desktop official release channel (for verification of version 7.2.9 and later): https://desktop.telegram.org/

No public proof-of-concept, exploit code, Nuclei template, or confirmed in-the-wild exploit campaign is currently associated with this CVE per available data. All exploitation details are inferred from the disclosed vulnerability class and the NVD description.