Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-107181 →
DEBIAN-CVE-2026-107181
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: r...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
telegram-desktop
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
telegram-desktop
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org