Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click
What you MUST NOT do and how to protect yourself:
• Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.
Download:
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• macOS: App Store.
• Linux: Flathub, Snapcraft.
Advice for users of older clients:
• Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.
• Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.
What is the issue?
A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link.
The main risk
The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.
#security #desktop #vulnerabilities
What you MUST NOT do and how to protect yourself:
• Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.
Download:
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• macOS: App Store.
• Linux: Flathub, Snapcraft.
Advice for users of older clients:
• Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.
• Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.
What is the issue?
A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link.
The main risk
The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.
#security #desktop #vulnerabilities
50🐳34🤯25😡20😱11👍6❤3🤡3
Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhile, the Messenger Replaced the Vulnerable Library
UPD 22:00 UTC. The researcher confirmed that Telegram has patched the flaw when migrated its clients to the tlottie library. Official clients users with latest updates installed are safe.
Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.
There is likely no direct threat to Telegram users on the latest versions of the official apps right now.
What exactly did the researchers find?
• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.
• Telegram relies on server-side verification to filter out malicious files.
• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.
• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.
Telegram replaced its sticker library
While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.
The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @tginfo editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.
Are these findings still relevant?
• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.
• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.
• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.
A systemic problem
The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.
Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.
In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @tginfo editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.
In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.
In the view of @tginfo editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @tginfo editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.
#vulnerabilities
UPD 22:00 UTC. The researcher confirmed that Telegram has patched the flaw when migrated its clients to the tlottie library. Official clients users with latest updates installed are safe.
Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.
There is likely no direct threat to Telegram users on the latest versions of the official apps right now.
What exactly did the researchers find?
• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.
• Telegram relies on server-side verification to filter out malicious files.
• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.
• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.
Telegram replaced its sticker library
While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.
The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @tginfo editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.
Are these findings still relevant?
• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.
• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.
• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.
A systemic problem
The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.
Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.
In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @tginfo editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.
In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.
In the view of @tginfo editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @tginfo editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.
#vulnerabilities
👍19🤡12🌚5❤2🐳1