A researcher showed that one click on a crafted link in Telegram Desktop could make the app read files from your computer and send them to an attacker. Those files can include your Telegram login, which lets the attacker take over your account. Telegram fixed it in version 7.2.9 (released Sept 17, 2026).
- Status
- Patched: update now
- Being attacked?
- Not known[2]
- Severity
- High
- Updated
No report that anyone has used this bug against real people. Severity: NVD score 8.6 out of 10 (CVE-2026-107181) First reported .
Am I affected?
You are at risk if you use Telegram Desktop 7.2.8 or older. The researcher tested it on Windows. Update to 7.2.9 or newer (the newest is 7.3.3 as of Oct 21, 2026).
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Telegram Desktop | Windows | Telegram Desktop 7.2.8 and older | 7.2.9[1][2] |
| Telegram Desktop | Mac | Telegram Desktop 7.2.8 and older (researcher tested on Windows only) | 7.2.9[1][2] |
| Telegram Desktop | Linux | Telegram Desktop 7.2.8 and older (researcher tested on Windows only) | 7.2.9[1][2] |
How to check your version
These checks only look. They do not change anything on your computer.
Telegram Desktop on Windows
Easy way: Open Telegram. Open Settings. The version number is shown in Settings (look under Advanced or at the bottom).
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Telegram*' | Select-Object DisplayName,DisplayVersion
Telegram Desktop on Mac
Easy way: Open Telegram. Menu bar: Telegram > About Telegram.
Or type this in TerminalRead-only. It only reads the version and changes nothing.
defaults read "/Applications/Telegram.app/Contents/Info" CFBundleShortVersionString
Telegram Desktop on Linux
Easy way: Open the app and look in its Help or About menu, or check your software manager.
How to fix it
- Open Telegram Desktop. It usually updates itself.
- If not, download the newest version from the official Telegram Desktop website.
- Do not click links from people or groups you do not know.
More on each app: Is my Telegram up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/telegram-desktop-link-account-takeover.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-107181
Sources
- NVDNVD: CVE-2026-107181 (Oct 7, 2026)
- MakerTelegram Desktop release v7.2.9 (Sep 17, 2026)
- Researcherbeaksec: Telegram Desktop one-click account takeover (researcher write-up) (October 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.