Security researcher Emiliano Versini disclosed a critical vulnerability in Telegram Desktop, identified as CVE-2026-107181. The vulnerability affects versions prior to 7.2.9, with confirmed impact down to 7.2.8, and was reproduced on Windows version 6.9.3. The National Vulnerability Database included it on October 7.

The public rating is critical. CVSS 4.0 score is 8.6, CVSS 3.1 score is 8.1, with vectors indicating user interaction is required and no prior permissions are needed. The consequence is that local files can be read and sent to an attacker-controlled session, including tdata session keys, which could allow account recovery on other devices. Availability impact is noted as none.

The timeline shows that the researcher reported it to ZDI on June 25. Telegram independently fixed it on September 16, submitting it as db3405699f, and released version 7.2.9 the next day. ZDI closed the case on September 30, marking it as fixed, and the disclosure rights returned to the researcher. A technical article was made public on October 3, and the CVE was assigned on October 7. The fixed version removed the related local sending processing and added escaping for inter-process communication delimiters.

Cryptocurrency projects, community administrators, and trading groups extensively use Telegram as a wartime channel. If mnemonic phrases, private key screenshots, and transaction records are left on the desktop computer, they will be on the same machine as the session files. Local passwords cannot prevent files from being read; they only make it harder for stolen sessions to be directly activated. The only way to close the vulnerability is to upgrade to version 7.2.9 or higher.

Reports indicate that the desktop version released 7.3 on October 9, with update notes containing only the word "Money." Version 7.2.9 remains the starting point for the public record of the fix, and earlier versions are not on the unaffected list. The vulnerability credit is attributed to Emiliano Versini, with coordination by VulnCheck.

This is not a trade but a transfer of session control. The buyer is the attacker who gains access to the sessions of users who have not upgraded, while the seller is the desktop users still on version 7.2.8 or earlier. The event is driven by the public analysis on October 3 and the CVE entry on October 7, not by changes in the supply and demand of any token. The beneficiaries are teams that have completed the upgrade and moved their keys off the chat computer; the pressured parties are projects that store sessions, screenshots, and group management permissions on the same computer, as a single click could hand over account access.

The desktop and mobile versions do not share the same update chain. Updating only the mobile version does not cover the old version on this computer. External links appearing in groups should not be opened until the upgrade is complete.

Source: Public Information