Telegram Desktop before version 7.2.9 contains an IPC record‑separator injection flaw in the Core::Sandbox component that allows attackers to inject OPEN: records through crafted tg:// links that include unescaped semicolons. When a user opens such a link the interpret: scheme handler is invoked and can upload local files, including session keys stored in the tdata directory, to an attacker‑controlled channel. The vulnerability is a CWE‑143 flaw and results in compromise of confidentiality, integrity, and availability by allowing an attacker to take over a victim’s account. The impact is direct and severe, as any user who opens a malicious link can inadvertently leak credentials and session information. The flaw does not require local code execution, and the traffic to the interpret: handler is normally permitted, making exploitation straightforward.

Telegram Desktop versions prior to 7.2.9 are affected. The compromised product is Telegram Desktop developed by Telegram, with the vulnerability present in releases 7.2.8 and earlier. Users of these versions must be aware that untrusted tg:// links can trigger the exploit.

The CVSS score of 8.6 classifies the vulnerability as high severity, and while the EPSS score is not available, the lack of a KEV listing does not diminish the potential risk. Attackers can reach the vulnerable component remotely by tricking a user into opening a specially crafted tg:// link, which the application processes as a command to upload local files. Once the interpreter processes the malicious record separator, the attacker can retrieve the session key and assume control of the victim’s Telegram account. The exploit is straightforward, requires no advanced prerequisites beyond social engineering, and could be automated by malicious sites or malware. This combination of high severity, ease of triggering, and sensitive data exfiltration underlines the urgency of remediation.