{"id":"CVE-2019-10044","details":"Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.","modified":"2026-07-08T18:17:09.689400Z","published":"2019-03-25T20:29:00.863Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/107610"},{"type":"EVIDENCE","url":"https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/telegramdesktop/tdesktop","events":[{"introduced":"0"},{"fixed":"d3159d86daad2584f23ecba24d2af2519d5f1497"}],"database_specific":{"cpe":"cpe:2.3:a:telegram:telegram_desktop:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.5.12"}],"source":"CPE_RANGE"}}],"versions":["v1.5.11","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.17","v1.3.16","v1.3.15","v1.3.14","v1.3.13","v1.3.12","v1.3.11","v1.3.10","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.25","v1.2.24","v1.2.23","v1.2.22","v1.2.21","v1.2.20","v1.2.19","v1.2.18","v1.2.17","v1.2.16","v1.2.15","v1.2.14","v1.2.13","v1.2.12","v1.2.11","v1.2.10","v1.2.9","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.29","v1.1.28","v1.1.27","v1.1.26","v1.1.25","v1.1.24","v1.1.23","v1.1.22","v1.1.21","v1.1.20","v1.1.19","v1.1.18","v1.1.17","v1.1.16","v1.1.15","v1.1.14","v1.1.13","v1.1.12","v1.1.11","v1.1.10","v1.1.9","v1.1.8","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.38","v1.0.37","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.27","v1.0.28","v1.0.26","v1.0.25","v1.0.24","v1.0.23","v1.0.22","v1.0.21","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.10.20","v0.10.19","v0.10.18","v0.10.16","v0.10.15","v0.10.14","v0.10.6","v0.10.5","v0.10.4","v0.10.2","v0.10.1","v0.9.57","v0.9.56","v0.9.51","v0.9.50","v0.9.49","v0.9.46","v0.9.45","v0.9.43","v0.9.36","v0.9.35","v0.9.34","v0.9.31","v0.9.30","v0.9.29","v0.9.28","v0.9.27","v0.9.24","v0.9.23","v0.9.22","v0.9.21","v0.9.20","v0.9.19","v0.9.14","v0.9.13","v0.9.12","v0.9.11","v0.9.8","v0.9.7","v0.9.6","v0.8.55","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.59","v0.8.58","v0.8.54","v0.8.53","v0.8.52","v0.8.51","v0.8.50","v0.8.49","v0.8.48","v0.8.45","v0.8.44","v0.8.43","v0.8.42","v0.8.41","v0.8.40","v0.8.39","v0.8.38","v0.8.35","v0.8.34","v0.8.33","v0.8.32","v0.8.31","v0.8.30","v0.8.29","v0.8.28","v0.8.27","v0.8.26","v0.8.25","v0.8.24","v0.8.23","v0.8.22","v0.8.21","v0.8.19","v0.8.18","v0.8.17","v0.8.16","v0.8.15","v0.8.14","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.5","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.26","v0.7.25","v0.7.24","v0.7.23","v0.7.22","v0.7.21","v0.7.20","v0.7.18","v0.7.17","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.21","v0.6.20","v0.6.19","v0.6.18","v0.6.17","v0.6.14","v0.6.13","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.21","v0.5.20","v0.5.19","v0.5.18","v0.5.17","v0.5.16","v0.5.15","v0.5.14","v0.5.13","v0.5.12","v0.5.11","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.1","v0.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10044.json","vanir_signatures_modified":"2026-07-08T18:17:09Z","vanir_signatures":[{"source":"https://github.com/telegramdesktop/tdesktop/commit/d3159d86daad2584f23ecba24d2af2519d5f1497","target":{"file":"Telegram/SourceFiles/history/media/history_media_wall_paper.cpp","function":"HistoryWallPaper::draw"},"deprecated":false,"digest":{"function_hash":"257236032486038005471760493978114419581","length":3410},"id":"CVE-2019-10044-1ad1fbeb","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/d3159d86daad2584f23ecba24d2af2519d5f1497","target":{"function":"HistoryWallPaper::textState","file":"Telegram/SourceFiles/history/media/history_media_wall_paper.cpp"},"deprecated":false,"digest":{"length":604,"function_hash":"50766982251253832006856727781459083139"},"id":"CVE-2019-10044-1f801213","signature_type":"Function"},{"source":"https://github.com/telegramdesktop/tdesktop/commit/d3159d86daad2584f23ecba24d2af2519d5f1497","target":{"file":"Telegram/SourceFiles/data/data_document.cpp"},"deprecated":false,"digest":{"line_hashes":["93739302009797238062931960297833846634","269927577504486150492282281573550146470","295015059719972936522427168708357635411","287226841572688196495645022466840102446"],"threshold":0.9},"id":"CVE-2019-10044-6cb39e8f","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2019-10044-c07051e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/d3159d86daad2584f23ecba24d2af2519d5f1497","target":{"file":"Telegram/SourceFiles/data/data_document.cpp","function":"DocumentOpenClickHandler::Open"},"deprecated":false,"digest":{"function_hash":"119384698973179238845721363016230814800","length":3562}},{"id":"CVE-2019-10044-de522bca","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/d3159d86daad2584f23ecba24d2af2519d5f1497","target":{"file":"Telegram/SourceFiles/history/media/history_media_wall_paper.cpp"},"deprecated":false,"digest":{"line_hashes":["172746539367537744960666225306435362313","293059545267787951751432081249340103409","90834934799275110096206550120833851166","222633410799170060818261092826169821294","46841851774612916774419481806021907378","148768716051338013896804729196921437986","44116566840900107866009306404603497796","9777405947442701064614753201740511152"],"threshold":0.9}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}