Telegram has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 8.1 (high). Most affected products: Telegram Desktop (2), Telegram (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-111105High· 7.0Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability64CVE-2026-107181High· 8.1Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons57CVE-2026-94488High· 8.2Telegram Desktop before 6.9.4 allows XSS in the HTML exporter57
Telegram vulnerabilities
CVEs affecting Telegram, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-111105High· 7.00dayTelegram rlottie Numeric Truncation Remote Code Execution Vulnerability
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerabili…
CVE-2026-107181High· 8.1PoCTelegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the…
CVE-2026-94488High· 8.2PoCTelegram Desktop before 6.9.4 allows XSS in the HTML exporter
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. How…