{"id":"CVE-2026-107181","summary":"Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme","details":"Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.","modified":"2026-10-09T07:06:34.059502793Z","published":"2026-10-07T13:35:40.907Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107181.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-143"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107181.json"},{"type":"ADVISORY","url":"https://github.com/telegramdesktop/tdesktop/releases/tag/v7.2.9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107181"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/telegram-desktop-before-7.2.9-ipc-record-injection-file-exfiltration-via-interpret-scheme"},{"type":"FIX","url":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a"},{"type":"PACKAGE","url":"https://github.com/telegramdesktop/tdesktop"},{"type":"ARTICLE","url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/core/sandbox.cpp#L362-L364"},{"type":"ARTICLE","url":"https://github.com/telegramdesktop/tdesktop/blob/v7.2.8/Telegram/SourceFiles/support/support_helper.cpp#L673-L751"},{"type":"EVIDENCE","url":"https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/telegramdesktop/tdesktop","events":[{"introduced":"0"},{"fixed":"fb2e33209517e1a34637d837bfadb3783f2fd59c"},{"fixed":"db3405699f8fc3ae28a58d2348b7d13a43c0590a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"7.2.9"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v7.2.8","v7.2.7","v7.2.6","v7.2.5","v7.1.5","v7.1.4","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.9","v7.0.8","v7.0.7","v7.0.6","v7.0.5","v7.0.4","v7.0.3","v7.0.2","v7.0.1","v6.9.4","v6.9.3","v6.9.2","v6.9.1","v6.9.0","v6.8.5","v6.8.4","v6.8.3","v6.8.2","v6.8.1","v6.8.0","v6.7.8","v6.7.7","v6.7.6","v6.7.5","v6.7.4","v6.7.3","v6.7.2","v6.7.1","v6.7.0","v6.6.4","v6.6.3","v6.6.2","v6.6.1","v6.6.0","v6.5.1","v6.5.0","v6.4.4","v6.4.3","v6.4.2","v6.4.1","v6.4.0","v6.3.10","v6.3.9","v6.3.8","v6.3.7","v6.3.6","v6.3.4","v6.3.3","v6.3.2","v6.3.1","v6.3.0","v6.2.6","v6.2.5","v6.2.4","v6.2.3","v6.2.2","v6.2.0","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1.0","v6.0.3","v6.0.2","v6.0.1","v6.0.0","v5.16.6","v5.16.5","v5.16.4","v5.16.3","v5.16.2","v5.16.1","v5.16.0","v5.15.4","v5.15.3","v5.15.2","v5.15.1","v5.15.0","v5.14.3","v5.14.2","v5.14.1","v5.14.0","v5.13.1","v5.13.0","v5.12.6","v5.12.5","v5.12.4","v5.12.3","v5.12.2","v5.12.1","v5.12.0","v5.11.1","v5.11.0","v5.10.7","v5.10.6","v5.10.5","v5.10.4","v5.10.3","v5.10.2","v5.10.1","v5.10.0","v5.9.2","v5.9.1","v5.9.0","v5.8.5","v5.8.4","v5.8.3","v5.8.2","v5.8.1","v5.8.0","v5.7.4","v5.7.3","v5.7.2","v5.7.1","v5.7.0","v5.6.4","v5.6.3","v5.6.2","v5.6.1","v5.6.0","v5.5.8","v5.5.7","v5.5.6","v5.5.5","v5.5.4","v5.5.3","v5.5.2","v5.5.1","v5.5.0","v5.4.6","v5.4.5","v5.4.4","v5.4.3","v5.4.2","v5.4.1","v5.4.0","v5.3.2","v5.3.1","v5.3.0","v5.2.6","v5.2.5","v5.2.4","v5.2.3","v5.2.2","v5.2.1","v5.2.0","v5.1.8","v5.1.7","v5.1.6","v5.1.5","v5.1.4","v5.1.3","v5.1.2","v5.1.1","v5.1.0","v5.0.6","v5.0.5","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0","v4.16.10","v4.16.9","v4.16.8","v4.16.7","v4.16.6","v4.16.5","v4.16.4","v4.16.3","v4.16.2","v4.16.1","v4.16.0","v4.15.7","v4.15.6","v4.15.5","v4.15.4","v4.15.3","v4.15.2","v4.15.1","v4.15.0","v4.14.16","v4.14.15","v4.14.14","v4.14.13","v4.14.12","v4.14.11","v4.14.10","v4.14.9","v4.14.8","v4.14.7","v4.14.6","v4.14.5","v4.14.4","v4.14.3","v4.14.2","v4.14.1","v4.14.0","v4.13.1","v4.13.0","v4.12.2","v4.12.1","v4.12.0","v4.11.8","v4.11.7","v4.11.6","v4.11.5","v4.11.4","v4.11.3","v4.11.2","v4.11.1","v4.11.0","v4.10.5","v4.10.4","v4.10.3","v4.10.2","v4.10.0","v4.9.9","v4.9.8","v4.9.7","v4.9.6","v4.9.5","v4.9.4","v4.9.3","v4.9.2","v4.9.1","v4.9.0","v4.8.12","v4.8.11","v4.8.10","v4.8.9","v4.8.8","v4.8.7","v4.8.6","v4.8.5","v4.8.4","v4.8.3","v4.8.1","v4.8.0","v4.7.1","v4.7.0","v4.6.12","v4.6.11","v4.6.10","v4.6.9","v4.6.8","v4.6.7","v4.6.6","v4.6.5","v4.6.4","v4.6.3","v4.6.2","v4.6.1","v4.6.0","v4.5.9","v4.5.8","v4.5.7","v4.5.6","v4.5.5","v4.5.3","v4.5.2","v4.5.1","v4.5.0","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.4","v4.3.3","v4.3.1","v4.3.0","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.2","v4.1.1","v4.1.0","v4.0.4","v4.0.2","v4.0.1","v4.0.0","v3.7.6","v3.7.5","v3.7.4","v3.7.3","v3.7.2","v3.7.1","v3.7.0","v3.6.3","v3.6.1","v3.6.0","v3.5.6","v3.5.5","v3.5.4","v3.5.3","v3.5.2","v3.5.1","v3.5.0","v3.4.8","v3.4.7","v3.4.6","v3.4.5","v3.4.4","v3.4.3","v3.4.2","v3.4.1","v3.4.0","v3.3.2","v3.3.1","v3.3.0","v3.2.8","v3.2.6","v3.2.5","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.13","v3.1.12","v3.1.11","v3.1.10","v3.1.9","v3.1.8","v3.1.7","v3.1.6","v3.1.5","v3.1.4","v3.1.3","v3.1.2","v3.1.1","v3.1.0","v3.0.5","v3.0.4","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.9.14","v2.9.13","v2.9.12","v2.9.11","v2.9.10","v2.9.8","v2.9.7","v2.9.6","v2.9.5","v2.9.4","v2.9.3","v2.9.2","v2.9.0","v2.8.13","v2.8.12","v2.8.11","v2.8.10","v2.8.9","v2.8.8","v2.8.6","v2.8.5","v2.8.4","v2.8.3","v2.8.2","v2.8.1","v2.8.0","v2.7.10","v2.7.9","v2.7.8","v2.7.7","v2.7.5","v2.7.4","v2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.8","v2.6.7","v2.6.6","v2.6.5","v2.6.4","v2.6.3","v2.6.2","v2.6.1","v2.6.0","v2.5.9","v2.5.8","v2.5.7","v2.5.6","v2.5.5","v2.5.4","v2.5.3","v2.5.2","v2.5.1","v2.5.0","v2.4.15","v2.4.14","v2.4.13","v2.4.12","v2.4.11","v2.4.10","v2.4.9","v2.4.8","v2.4.7","v2.4.6","v2.4.5","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.2","v2.3.1","v2.3.0","v2.2.0","v2.1.22","v2.1.21","v2.1.20","v2.1.19","v2.1.18","v2.1.17","v2.1.16","v2.1.15","v2.1.14","v2.1.13","v2.1.12","v2.1.11","v2.1.10","v2.1.9","v2.1.8","v2.1.7","v2.1.6","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.1","v2.0.0","v1.9.22","v1.9.21","v1.9.20","v1.9.19","v1.9.18","v1.9.17","v1.9.16","v1.9.15","v1.9.14","v1.9.13","v1.9.12","v1.9.11","v1.9.10","v1.9.9","v1.9.8","v1.9.7","v1.9.6","v1.9.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.9.0","v1.8.15","v1.8.14","v1.8.13","v1.8.12","v1.8.11","v1.8.10","v1.8.9","v1.8.8","v1.8.7","v1.8.5","v1.8.4","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.15","v1.7.14","v1.7.13","v1.7.12","v1.7.11","v1.7.10","v1.7.9","v1.7.8","v1.7.7","v1.7.6","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.7","v1.6.6","v1.6.5","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.18","v1.5.17","v1.5.16","v1.5.15","v1.5.13","v1.5.12","v1.5.11","v1.5.10","v1.5.9","v1.5.8","v1.5.7","v1.5.6","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.8","v1.4.7","v1.4.6","v1.4.5","v1.4.4","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.17","v1.3.16","v1.3.15","v1.3.14","v1.3.13","v1.3.12","v1.3.11","v1.3.10","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.25","v1.2.24","v1.2.23","v1.2.22","v1.2.21","v1.2.20","v1.2.19","v1.2.18","v1.2.17","v1.2.16","v1.2.15","v1.2.14","v1.2.13","v1.2.12","v1.2.11","v1.2.10","v1.2.9","v1.2.8","v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.29","v1.1.28","v1.1.27","v1.1.26","v1.1.25","v1.1.24","v1.1.23","v1.1.22","v1.1.21","v1.1.20","v1.1.19","v1.1.18","v1.1.17","v1.1.16","v1.1.15","v1.1.14","v1.1.13","v1.1.12","v1.1.11","v1.1.10","v1.1.9","v1.1.8","v1.1.7","v1.1.6","v1.1.5","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.38","v1.0.37","v1.0.36","v1.0.35","v1.0.34","v1.0.33","v1.0.32","v1.0.31","v1.0.30","v1.0.29","v1.0.27","v1.0.28","v1.0.26","v1.0.25","v1.0.24","v1.0.23","v1.0.22","v1.0.21","v1.0.20","v1.0.19","v1.0.18","v1.0.17","v1.0.16","v1.0.15","v1.0.14","v1.0.13","v1.0.12","v1.0.11","v1.0.10","v1.0.9","v1.0.8","v1.0.7","v1.0.6","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.10.20","v0.10.19","v0.10.18","v0.10.16","v0.10.15","v0.10.14","v0.10.6","v0.10.5","v0.10.4","v0.10.2","v0.10.1","v0.9.57","v0.9.56","v0.9.51","v0.9.50","v0.9.49","v0.9.46","v0.9.45","v0.9.43","v0.9.36","v0.9.35","v0.9.34","v0.9.31","v0.9.30","v0.9.29","v0.9.28","v0.9.27","v0.9.24","v0.9.23","v0.9.22","v0.9.21","v0.9.20","v0.9.19","v0.9.14","v0.9.13","v0.9.12","v0.9.11","v0.9.8","v0.9.7","v0.9.6","v0.8.55","v0.9.3","v0.9.2","v0.9.1","v0.9.0","v0.8.59","v0.8.58","v0.8.54","v0.8.53","v0.8.52","v0.8.51","v0.8.50","v0.8.49","v0.8.48","v0.8.45","v0.8.44","v0.8.43","v0.8.42","v0.8.41","v0.8.40","v0.8.39","v0.8.38","v0.8.35","v0.8.34","v0.8.33","v0.8.32","v0.8.31","v0.8.30","v0.8.29","v0.8.28","v0.8.27","v0.8.26","v0.8.25","v0.8.24","v0.8.23","v0.8.22","v0.8.21","v0.8.19","v0.8.18","v0.8.17","v0.8.16","v0.8.15","v0.8.14","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.5","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.7.26","v0.7.25","v0.7.24","v0.7.23","v0.7.22","v0.7.21","v0.7.20","v0.7.18","v0.7.17","v0.7.16","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.21","v0.6.20","v0.6.19","v0.6.18","v0.6.17","v0.6.14","v0.6.13","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.21","v0.5.20","v0.5.19","v0.5.18","v0.5.17","v0.5.16","v0.5.15","v0.5.14","v0.5.13","v0.5.12","v0.5.11","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.1","v0.5.0"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":454,"function_hash":"210710216930021699418150969256999186164"},"id":"CVE-2026-107181-18278a6a","signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.cpp","function":"Sandbox::removeClients"}},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["75713378035556375423835449791327151395","223727024801634372055012943293028098386","319733657832981076904904260198039877217","178745767769606394232262946079072463413","108155464478615931703411384828665829411","72043048468752501636193186259069738464","38012804010411242619615273039395864053","175006506623085522569705055882015570312","86139236994911892907765852609461503804","329250435652461893873869250988028052578","267457468875315683533426834730793289726","261375542494718211942620732911790706303","67055586836038594315255405155595847196","262425157016835496940945508095269983273","206943379281456056348772769351891593872","286331268692597722699958106768086167320","301773965932893388080883863627117472215","104261267401485981591986187759665407126","338960957952771429165501725413752102732","329175217077363112911717857118416975594","2278597548556556473646077268307707546","16600739749838443290587892587159277817","125204908328016008887399711549354502617","133748606845764923206747816073388829684","139767195753869084289504755756147281679","268432448625515236569216648033316019156","244482871257524765178621664808149395737","253795618855956098648697747783519380913","35319609871785607317260264031020802041","75883852699987900721368534677462542572","65269707026900706326158021010483965225","246012460145271604427304378393961265025","199849520569727728096854619688777759519","223661649615624684341730213841190857203","307937128283351700764790648591666100856","192929022431898560506244541281238503518","80460659485098343052064069021667887418","232523506378950083910395518957595360458","150798216917983466783828925414270112434","182568746093966260320394091914225348727","317937375161771928025067763322137261455","84478956244902922611862630230424462519","32085797011316007889440891750153486831","328234390994684899490836329726206030994","321940222580737336213568216535185512307","280393980420033480672619363086281952352","157581021680548917706000203251784233336","99606363914027278482279558342776897510","166721246981914536675082508458619287544","94114291333252901826627007168427845863","197717914802684130822231565506008191766","51697437845462142014232460613577805938","84580067867269438653918896241504653937","257901919115311526722256422481757663026","50421819999132619142355118561459685049","309525498259011918798477132002804022677","212356851764234278606318091136247906273","305225783523114813324107883228001748491","206144445176160761145721213791727965553","63258104251047348650224599276590297870","205236401151353627127516687477921543322","120302067084818550626989030718072267593","173648571203737334626252980786244843846","234458783181918677073408970428176844772","191609614058213937229687956677630991556","181000656982970509778345642687645565620","253353643415756775562038419269759746113","124170624517493527643623324358378710819","265015979982192224191770018001689418710","22242956442912686205679042781262050047","127129211439763806871055553566154957138","296871384953259698908018052367968767086","191746690212063866086566158425039599881","210088185445500072671327804652001056927","87521148680458723232654952958001123298","154912343293906860139086271433527156906","117951457714048192985619291169789231252","88078900377331237777855527912893316603","170738402060621956802318192256440153001","77130067550713402725149337157243187287","216965658612288989994689619983875640799","327555090325161723155286053035149769399","321897196432032339387608060851942964435","33277758172648357684296121624912625063","191678971214436258793135454683157420132","222856304330454515345071319751170462250","228926207836573831838418681571571905546","123551683343123470112548132373268208001","207731036912871406867215251228573607482","72654941979406413564451064407281659997","212161264496092347074184488399280461191","125053782523323306982921955182200686542","212530911044278056672203238475446909606","329997376936008381173101625448244177993"]},"id":"CVE-2026-107181-19b3ba50","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/support/support_helper.cpp"}},{"target":{"file":"Telegram/SourceFiles/mainwidget.cpp"},"deprecated":false,"digest":{"line_hashes":["187012211939088333671446225636854032548","8364187122467573276741081985696830530","156447860019307853294327496746535478679","18715852028560675324890596511353700647","85516045287037479436312432578229098072","271826997315379479171510952281341176239","258016334923815018410158739783952807601","53698497202657908063697258871653751282","242052792958482527709549775586348468310","118811447390154238317603687518845407388","59191969813310810068742326654835826043","57178104286274352169930572936586724235","259471474264789985831770408692015446946","17794630775610680892807387945932406078","80350311999157555836308562588783565481","105607214554410535725279718432306976602","321584669275254776215109855868007669880","76667424455346470758053563616134423584"],"threshold":0.9},"id":"CVE-2026-107181-33319e55","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a"},{"source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.cpp","function":"Sandbox::socketConnected"},"deprecated":false,"digest":{"function_hash":"103460315226219850616445577544500428675","length":676},"id":"CVE-2026-107181-518d0563","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"124938810205816629919944911807195877036","length":444},"id":"CVE-2026-107181-5730c3d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.cpp","function":"Sandbox::newInstanceConnected"}},{"deprecated":false,"digest":{"function_hash":"202845333608129283943223243579039235356","length":389},"id":"CVE-2026-107181-6fda86ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"function":"Sandbox::closeApplication","file":"Telegram/SourceFiles/core/sandbox.cpp"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["150427154740788519256146465286569443960","285577426538104897725863902922967903128","142823616422422838143112518315906545284","73193252541610697328537781740089347531"]},"id":"CVE-2026-107181-7b3e1b9d"},{"signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/fb2e33209517e1a34637d837bfadb3783f2fd59c","target":{"file":"Telegram/SourceFiles/core/version.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200817096982911642717868426679918357370","27304416895377911746940904098522661309","160536017270877548371948214662718375022","107148569826636941522840191076580230201"]},"id":"CVE-2026-107181-80b68675","signature_type":"Line"},{"source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/mainwindow.cpp","function":"MainWindow::handleStartFiles"},"deprecated":false,"digest":{"function_hash":"97055016240137900268464598064365008237","length":288},"id":"CVE-2026-107181-844eb1c9","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/mainwidget.cpp","function":"MainWidget::handleStartFiles"},"deprecated":false,"digest":{"function_hash":"190281224262979350567021668804364824842","length":480},"id":"CVE-2026-107181-898b6374"},{"digest":{"threshold":0.9,"line_hashes":["204112559809973943203242685323333124254","74566037415581787470622003971828880658","286875832039514552190286968183016612612","111784932485865834889138002220557891195","310834772444522100475832774578407332866","227872225700586460942827450379718529074","190947825510962595515283275691902750972","31229010477304023160996585257576372544","161055800488520593206141280166896843239","299826990868977188735912258229578556125","229387497635762952415180088996478483466","315953117302352466899943015901929053609","320129636952057880359410848939677498802","110482901502354241405346436511624837190","252601065456729877763690983970150241017"]},"id":"CVE-2026-107181-8f32c091","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/mainwindow.cpp"},"deprecated":false},{"target":{"file":"Telegram/SourceFiles/mainwindow.h"},"deprecated":false,"digest":{"line_hashes":["140016036967793576120800484198903249916","335025073479198521890622601548248893939","245122409536164988901198096491193756064","327038724363561337819282277054296763305"],"threshold":0.9},"id":"CVE-2026-107181-94efcb31","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a"},{"source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/application.cpp"},"deprecated":false,"digest":{"line_hashes":["262472191691536541354455868011107254170","284804203133798042520595155852147846775","319378804938298162823591872676197411055","67897315914031454601738914406472300160","227047416483178259261478872213281205189","59516764448999443455150032453152928712","18673652523578521897217937350706160697","120380652009154160771586463587365503564","158611053014992466306918977043851391022","193686247741191706956655352121351278533","23811175123355761665112769259496630981","63971280901635014814546212780189088078","45225215302384624353064340310441873906","30562548950149644364575900828539800834","158145493151889260360886046946068150266","94135964989665667948430697248486953015","34427466756881752755588399225689002321","77440817200261387528926618080070285384","163658887385848631038413584108567639460","110482901502354241405346436511624837190"],"threshold":0.9},"id":"CVE-2026-107181-98b610ab","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.cpp","function":"Sandbox::readClients"},"deprecated":false,"digest":{"function_hash":"206890864464281137443970358584370297723","length":2028},"id":"CVE-2026-107181-a2dd3fda"},{"digest":{"line_hashes":["315006220925670334706943251300117384436","80440567810854881500305490628035362715","107681914685467508992882774852081623606","140633231011932113190517885816925024207"],"threshold":0.9},"id":"CVE-2026-107181-a6117c10","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/support/support_helper.h"},"deprecated":false},{"id":"CVE-2026-107181-b9643840","signature_type":"Function","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"function":"Application::checkStartUrls","file":"Telegram/SourceFiles/core/application.cpp"},"deprecated":false,"digest":{"function_hash":"212728329024940076300444009619776150652","length":1239}},{"source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a","target":{"file":"Telegram/SourceFiles/core/sandbox.cpp"},"deprecated":false,"digest":{"line_hashes":["300563202707562057693319420921503193522","264647762186882670433760144871169593432","128984949634742798806426139968974794008","74741339118833865139180617908929192280","225513384199835082488927995501909457127","248766113605769580551411847377400343528","214989559374313375081809214914370963816","154021295300439446044174803063126792922","24185948404460102270237969726907197838","174760758844129233461311724127924175988","58723467771541141183511605081971555177","283348118665891320726326024740165331311","6474528345505033773158410845972519132","49036306338841503568251386835723619213","26897690971435910615009304419897287196","87510510302844889098224141674114740292","142630017493413760290347386945659669608","271640688770994721617764872432385068281","300125982852895730970710050121030400655","104298101122897338332861336579811088468","145839749257647212404265774465432160775","216681900181946812486014463281586276828","62921093183042614102080291204486749938","291628452022662929608685509301619938685","154408094798492569944459815914430187376","248043345835475140370869963710138052606","5864685663301340668373268103620197028","247769385640370246933180240157036283438","43485693091992968484206014655670768960","210004427312961383013929737279646230458","53933575206052935580949620626197291380","273939680902075630393850701990944841853","215906108700189329130563244035933363825","23067048250225627374447689140834941074","236393094708243100660232589124106402346","49193900598739973999241809725629315590","333801472675224868554372934610166225785","332669691079051749336938189400858118954","66983262530876387330153933414211740252","301433333514172948172971011743496915184","322374193545978229354724516572306997916","71689543288883078766523397564700697284","324937266447598323881998173274649051468","188642518149169394787396840260284484151","129944819324952001993416077197985372916","339465829945044245417949367360834354168","36459266917499450596424181154797733117","100218880461577880259039758113086425514","69661429594444480185194524324226302733","197691567121457017099263668735730389229","203309674363040147137653031619309555159","64250261365134732862212196997562430942","12408196547608092668749788209912746649","260908623294922214852743295949659720367","20947996061701832856223647756966357933","213082214102680963759687850226267838426","170458787599841381663908545786298471386","35153726454450337578177951868292520316","274919624473974335578794764885454280906","21668473439887098821329443522880487958","92793031252038034195668988049009086544","12096550705004082251000177055492480103","300034737845620906629590780042777635562"],"threshold":0.9},"id":"CVE-2026-107181-bf2f3fa4","signature_type":"Line","signature_version":"v1"},{"target":{"file":"Telegram/SourceFiles/mainwidget.h"},"deprecated":false,"digest":{"line_hashes":["183656732000836432142718194307334330382","16283534300584597944610912858923921120","263414661637128860250131912843741590392","256869007100189674840936540798592947504"],"threshold":0.9},"id":"CVE-2026-107181-dc94f3b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/telegramdesktop/tdesktop/commit/db3405699f8fc3ae28a58d2348b7d13a43c0590a"}],"vanir_signatures_modified":"2026-10-09T07:06:34Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107181.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}