A high-risk vulnerability in Telegram Desktop could lead to account takeover; fixed in version 7.2.9.

PANews October 9 news, according to security researcher BeakSec, Telegram Desktop previously had a high-risk vulnerability CVE-2026-107181. An attacker could pre-place an instruction file in a group where the victim is located, then induce the victim to click a link redirected through the browser, using inter-process communication command injection to send local files to a group controlled by the attacker; if the session file is stolen and the user has not set a local password, the account may be taken over. The researcher said versions 7.2.8 and earlier are affected, and the vulnerability has been fixed in version 7.2.9 released on September 17.