Telegram vulnerabilities
We track 3 vulnerabilities in Telegram products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest Telegram vulnerabilities
- 7.0 High severity
Telegram: Numeric Truncation Error
Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target m
- 8.1 High severity
Telegram Desktop: Improper Neutralization of Record Delimiters
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme hand
- 8.2 High severity
Telegram Desktop: Improper Neutralization of Input During Web Page Generation
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8 in export_output_html.cpp. Exploitation cannot occur unless HTML export was used by a victim. However, the exploit paylo