Critical Vulnerability in Telegram Desktop Has Been Fixed
Security researcher Emiliano Versini disclosed a critical vulnerability in Telegram Desktop, identified as CVE-2026-107181. The vulnerability affects versions prior to 7.2.9, with confirmed impact down to 7.2.8, and was reproduced on Windows version 6.9.3. The National Vulnerability Database included it on October 7.
The public rating is critical. CVSS 4.0 score is 8.6, CVSS 3.1 score is 8.1, with vectors indicating user interaction is required and no prior permissions are needed. The consequence is that local files can be read and sent to an attacker-controlled session, including tdata session keys, which could allow account recovery on other devices. Availability impact is noted as none.
The timeline shows that the researcher reported it to ZDI on June 25. Telegram independently fixed it on September 16, submitting it as db3405699f, and released version 7.2.9 the next day. ZDI closed the case on September 30, marking it as fixed, and the disclosure rights returned to the researcher. A technical article was made public on October 3, and the CVE was assigned on October 7. The fixed version removed the related local sending processing and added escaping for inter-process communication delimiters.
Cryptocurrency projects, community administrators, and trading groups extensively use Telegram as a wartime channel. If mnemonic phrases, private key screenshots, and transaction records are left on the desktop computer, they will be on the same machine as the session files. Local passwords cannot prevent files from being read; they only make it harder for stolen sessions to be directly activated. The only way to close the vulnerability is to upgrade to version 7.2.9 or higher.
Reports indicate that the desktop version released 7.3 on October 9, with update notes containing only the word "Money." Version 7.2.9 remains the starting point for the public record of the fix, and earlier versions are not on the unaffected list. The vulnerability credit is attributed to Emiliano Versini, with coordination by VulnCheck.
This is not a trade but a transfer of session control. The buyer is the attacker who gains access to the sessions of users who have not upgraded, while the seller is the desktop users still on version 7.2.8 or earlier. The event is driven by the public analysis on October 3 and the CVE entry on October 7, not by changes in the supply and demand of any token. The beneficiaries are teams that have completed the upgrade and moved their keys off the chat computer; the pressured parties are projects that store sessions, screenshots, and group management permissions on the same computer, as a single click could hand over account access.
The desktop and mobile versions do not share the same update chain. Updating only the mobile version does not cover the old version on this computer. External links appearing in groups should not be opened until the upgrade is complete.
Source: Public Information
ABAB AI Insight
The security ledger of Telegram Desktop has always followed client patching rather than server announcements. Around 2023, the desktop version was repeatedly pointed out by security teams for local data storage and session file locations, leading the project to make local passwords optional rather than default locks. This time, the path of CVE-2026-107181 is similar: reported to ZDI on June 25, independently submitted by the vendor on September 16 as db3405699f, version 7.2.9 released on September 17, with public analysis and CVE falling after the fix. Emiliano Versini received credit for the discovery, not for an unpatched window.
The crypto community places the entry point for operational funds in chat software. Projects use Telegram groups for announcements, customer service responses, and payment confirmations, with administrator accounts themselves being distribution points for the vault keys. If mnemonic phrase screenshots, private key exports, and transaction records are stored on the same computer as the tdata session, the client vulnerability can turn the communication channel into an asset channel. Local passwords only reduce the usability of stolen sessions, not change the fact that files have been read.
Comparatively, after the misuse of Twitter employee tools in 2020, celebrity accounts were used to post phishing; and later, session theft targeted Discord and Slack administrators. Telegram is in a control phase in the crypto space: it is not a custodian but holds the actual entry points for project announcements, customer service, and administrators. A desktop version stuck on 7.2.8 effectively leaves this entry point exposed to a known vulnerability.
Essentially, this is a trust anchor displacement in the restructuring of the industry chain. Transactions, communities, and customer service once treated account login states as internal tools; after the patch was made public, login states became transferable assets. The mechanism is the update time difference: the fix was submitted on September 16, but the CVE was only entered on October 7, allowing un-upgraded admin accounts to continue operating for three weeks. Those who upgrade first retain group access; those who store keys and sessions together hand over both sets of permissions in one go.
ABAB News · Cognitive Law
Patches land first, announcements arrive later, with a window in between.
Sessions are keys, screenshots are backups, storing them on the same machine equals merging.
Chat tools do not hold assets but can hold asset entry points.