Security researchers from BeakSec identified a critical vulnerability in the Telegram desktop client, tracked as CVE-2026-107181. The flaw, which received a CVSS score of 8.6, affected all versions prior to 7.2.9 and allowed attackers to remotely access and exfiltrate files from a user's computer after a single link click.
The issue stemmed from the improper handling of tg:// links. Attackers could inject commands into these links to trigger the interpret: handler, which read files from the disk and sent them to a chat without user confirmation. This method allowed for the theft of session files from the tdata folder, granting unauthorized account access.
BeakSec reported the vulnerability via the Zero Day Initiative on June 25, 2026. Telegram released a fix in version 7.2.9 on September 17, 2026, by removing the interpret: handler and implementing character escaping. While the official changelog only mentioned animation fixes, the update effectively mitigates the risk.
As of October 9, 2026, no instances of the vulnerability being exploited in real-world attacks have been recorded. Users are advised to update their desktop clients to version 7.2.9 or newer. Additionally, security experts recommend setting a local passcode to encrypt session files and limiting group invitation settings.
