{
 "schema_version": "1.0",
 "generated_at": "2026-11-07T18:30:10Z",
 "last_checked": "2026-11-07T17:33:08+00:00",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "product": {
  "slug": "telegram-desktop",
  "name": "Telegram Desktop",
  "short_name": "Telegram",
  "page_url": "https://patchgap.ai/is-my-telegram-up-to-date/",
  "minimum_safe_version": "7.2.9",
  "minimum_safe_version_source": [
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
    "title": "NVD: CVE-2026-107181",
    "date": "2026-10-07",
    "kind": "nvd"
   },
   {
    "url": "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9",
    "title": "Telegram Desktop release v7.2.9",
    "date": "2026-09-17",
    "kind": "vendor"
   }
  ],
  "baseline": {
   "version": "7.2.9",
   "applies_to": "all platforms listed for this product",
   "source_incident": "telegram-desktop-link-account-takeover",
   "sources": [
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
     "title": "NVD: CVE-2026-107181",
     "date": "2026-10-07",
     "kind": "nvd"
    },
    {
     "url": "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9",
     "title": "Telegram Desktop release v7.2.9",
     "date": "2026-09-17",
     "kind": "vendor"
    }
   ],
   "covers_everything_listed": true,
   "caveats": [],
   "text": "You're covered against everything listed here if you're on Telegram 7.2.9 or newer."
  },
  "update_steps": {
   "windows": [
    "Open Telegram > Settings > Advanced and check the version.",
    "Install the update it offers, or download it from desktop.telegram.org."
   ],
   "macos": [
    "Open Telegram > Settings > Advanced and check the version.",
    "Install the update it offers, or download it from desktop.telegram.org."
   ],
   "linux": [
    "Open Telegram > Settings > Advanced and check the version.",
    "Install the update it offers, or download it from desktop.telegram.org."
   ]
  },
  "last_checked": "2026-11-07T17:33:08+00:00",
  "vendor": "Telegram",
  "category": "apps",
  "platforms": [
   "windows",
   "macos",
   "linux"
  ],
  "what_it_is": "The Telegram messaging app for computers.",
  "url": "https://patchgap.ai/is-my-telegram-up-to-date/",
  "json_url": "https://patchgap.ai/products/telegram-desktop.json",
  "official_site": "https://desktop.telegram.org",
  "official_download": "https://desktop.telegram.org/",
  "how_it_updates": "Telegram Desktop updates itself. You can also download the newest version from the official site.",
  "check": {
   "windows": {
    "menu_path": "Open Telegram. Open Settings. The version number is shown in Settings (look under Advanced or at the bottom).",
    "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Telegram*' | Select-Object DisplayName,DisplayVersion",
    "shell": "PowerShell",
    "read_only": true
   },
   "macos": {
    "menu_path": "Open Telegram. Menu bar: Telegram > About Telegram.",
    "command": "defaults read \"/Applications/Telegram.app/Contents/Info\" CFBundleShortVersionString",
    "shell": "Terminal",
    "read_only": true
   },
   "linux": {
    "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
    "command": null,
    "shell": null,
    "read_only": null
   }
  },
  "open_incidents": [
   "telegram-desktop-link-account-takeover"
  ]
 },
 "incidents": [
  {
   "id": "telegram-desktop-link-account-takeover",
   "url": "https://patchgap.ai/incidents/telegram-desktop-link-account-takeover/",
   "path": "/incidents/telegram-desktop-link-account-takeover/",
   "json_url": "https://patchgap.ai/incidents/telegram-desktop-link-account-takeover.json",
   "title": "Telegram Desktop: clicking a bad link could let someone take over your account. Update to 7.2.9 or newer.",
   "category": "apps",
   "platforms": [
    "windows",
    "macos",
    "linux"
   ],
   "products": [
    "telegram-desktop"
   ],
   "status": "patched",
   "status_label": "Patched: update now",
   "severity": "high",
   "severity_source": "NVD score 8.6 out of 10 (CVE-2026-107181)",
   "exploited_in_wild": "unknown",
   "exploited_note": "No report that anyone has used this bug against real people.",
   "exploited_source_url": "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9",
   "confidence": "confirmed",
   "confidence_note": null,
   "first_reported": "2026-10-07",
   "updated_at": "2026-10-27",
   "cves": [
    "CVE-2026-107181"
   ],
   "summary": "A researcher showed that one click on a crafted link in Telegram Desktop could make the app read files from your computer and send them to an attacker. Those files can include your Telegram login, which lets the attacker take over your account. Telegram fixed it in version 7.2.9 (released Sept 17, 2026).",
   "am_i_affected": "You are at risk if you use Telegram Desktop 7.2.8 or older. The researcher tested it on Windows. Update to 7.2.9 or newer (the newest is 7.3.3 as of Oct 21, 2026).",
   "action": "Update Telegram Desktop to 7.2.9",
   "affected": [
    {
     "product": "telegram-desktop",
     "product_name": "Telegram Desktop",
     "platform": "windows",
     "affected_versions": "Telegram Desktop 7.2.8 and older",
     "fixed_version": "7.2.9",
     "fixed_min": "7.2.9",
     "fix_note": null,
     "fixed_source_urls": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
      "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9"
     ],
     "check": {
      "menu_path": "Open Telegram. Open Settings. The version number is shown in Settings (look under Advanced or at the bottom).",
      "command": "Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object DisplayName -like '*Telegram*' | Select-Object DisplayName,DisplayVersion",
      "shell": "PowerShell",
      "read_only": true
     },
     "official_download": "https://desktop.telegram.org/"
    },
    {
     "product": "telegram-desktop",
     "product_name": "Telegram Desktop",
     "platform": "macos",
     "affected_versions": "Telegram Desktop 7.2.8 and older (researcher tested on Windows only)",
     "fixed_version": "7.2.9",
     "fixed_min": "7.2.9",
     "fix_note": null,
     "fixed_source_urls": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
      "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9"
     ],
     "check": {
      "menu_path": "Open Telegram. Menu bar: Telegram > About Telegram.",
      "command": "defaults read \"/Applications/Telegram.app/Contents/Info\" CFBundleShortVersionString",
      "shell": "Terminal",
      "read_only": true
     },
     "official_download": "https://desktop.telegram.org/"
    },
    {
     "product": "telegram-desktop",
     "product_name": "Telegram Desktop",
     "platform": "linux",
     "affected_versions": "Telegram Desktop 7.2.8 and older (researcher tested on Windows only)",
     "fixed_version": "7.2.9",
     "fixed_min": "7.2.9",
     "fix_note": null,
     "fixed_source_urls": [
      "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
      "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9"
     ],
     "check": {
      "menu_path": "Open the app and look in its Help or About menu, or check your software manager.",
      "command": null,
      "shell": null,
      "read_only": null
     },
     "official_download": "https://desktop.telegram.org/"
    }
   ],
   "fix_steps": [
    "Open Telegram Desktop. It usually updates itself.",
    "If not, download the newest version from the official Telegram Desktop website.",
    "Do not click links from people or groups you do not know."
   ],
   "official_patch_links": [
    {
     "label": "Telegram Desktop: official download",
     "url": "https://desktop.telegram.org/"
    }
   ],
   "extra_checks": [],
   "sources": [
    {
     "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107181",
     "title": "NVD: CVE-2026-107181",
     "date": "2026-10-07",
     "kind": "nvd",
     "official": true
    },
    {
     "url": "https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9",
     "title": "Telegram Desktop release v7.2.9",
     "date": "2026-09-17",
     "kind": "vendor",
     "official": true
    },
    {
     "url": "https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/",
     "title": "beaksec: Telegram Desktop one-click account takeover (researcher write-up)",
     "date": "2026-10",
     "kind": "research",
     "official": false
    }
   ]
  }
 ]
}