en
Telegram is a global provider of a cloud-based messaging platform focused on speed, security, and synchronized communication. It serves individual users, communities, media organizations, and businesses through mobile, desktop, and web applications, with support for messaging, groups, channels, files, calls, bots, and APIs.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/24/2026, Telegram recorded 3 security vulnerabilities in the last 90 days across 2 products, including 3 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Telegram Desktop had the most security vulnerabilities in the Telegram ecosystem, with 2 vulnerabilities—approximately 66.67% of the provider's total vulnerabilities during this period.
CVE-2026-111105Telegram rlottie Numeric Truncation Remote Code Execution VulnerabilityCVE-2026-107181Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: SchemeCVE-2026-94488CVE-2026-94488CVE-2026-7701Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereferenceCVE-2021-47793Telegram Desktop 2.9.2 - Denial of Service (PoC)| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-111105Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability | Exploitation statusNot exploited | FixNo | Affected productTelegram | Published10/15/2026 | SeverityHigh |
CVE-2026-107181Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme | Exploitation statusActively exploited | FixYes | Affected productTelegram Desktop | ||
CVE-2026-94488CVE-2026-94488 | Exploitation statusActively exploited | FixYes | Affected productTelegram Desktop | Published09/21/2026 | |
CVE-2026-7701Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference | Exploitation statusActively exploited | FixNo | Affected productDesktop | Published | |
CVE-2021-47793Telegram Desktop 2.9.2 - Denial of Service (PoC) | Exploitation statusActively exploited | FixNo | Affected productTelegram Desktop | Published01/15/2026 | |
CVE-2024-7014Improper multimedia file attachment validation in Telegram for Android app | Exploitation statusNot exploited | FixYes | Affected productTelegram for Android | Published | |
CVE-2023-34658CVE-2023-34658 | Exploitation statusNot exploited | FixNo | Affected product- | Published06/29/2023 | SeverityUnknown |
CVE-2023-26818CVE-2023-26818 | Exploitation statusActively exploited | FixNo | Affected product- | Published05/19/2023 | SeverityMedium |
CVE-2022-43363CVE-2022-43363 | Exploitation statusNot confirmed | FixNo | Affected product- | Published12/06/2022 | SeverityUnknown |
CVE-2021-41861CVE-2021-41861 | Exploitation statusNot confirmed | FixNo | Affected product- | Published10/04/2021 | SeverityUnknown |
41 Results | Page 1 of 5
| SeverityHigh |
| SeverityMedium |
| SeverityMedium |
| SeverityHigh |