Filtered by vendor Telegram Subscriptions
Total 38 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-7701 1 Telegram 1 Telegram Desktop 2026-05-05 4.3 Medium
A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/url_auth_box.cpp of the component Bot API. The manipulation of the argument login_url leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2021-47793 2 Telegram, Telegram Desktop 3 Telegram, Telegram Desktop, Telegram Desktop 2026-03-05 7.5 High
Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attackers can generate a 9 million byte buffer and paste it into the messaging interface to trigger an application crash.
CVE-2024-7014 1 Telegram 1 Telegram 2026-02-09 8.1 High
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
CVE-2014-8688 1 Telegram 1 Messenger 2025-04-20 7.5 High
An issue was discovered in Telegram Messenger 2.6 for iOS and 1.8.2 for Android. Secret chat messages are available in cleartext in process memory and a .db file.
CVE-2017-17715 1 Telegram 1 Telegram Messenger 2025-04-20 N/A
The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows directory traversal via a pathname obtained in a file-transfer request from a remote peer, as demonstrated by writing to tgnet.dat or tgnet.dat.bak.
CVE-2023-26818 1 Telegram 1 Telegram 2025-01-21 5.5 Medium
Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.
CVE-2023-34658 1 Telegram 1 Telegram 2024-11-27 5.3 Medium
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
CVE-2022-43363 1 Telegram 1 Telegram 2024-11-21 6.1 Medium
Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relationship between the Pastebin information and a possible XSS finding.
CVE-2021-41861 1 Telegram 1 Telegram 2024-11-21 3.3 Low
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
CVE-2021-40532 1 Telegram 1 Web K Alpha 2024-11-21 9.8 Critical
Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension.
CVE-2021-37596 1 Telegram 1 Web K Alpha 2024-11-21 6.1 Medium
Telegram Web K Alpha 0.6.1 allows XSS via a document name.
CVE-2021-36769 1 Telegram 2 Telegram, Telegram Desktop 2024-11-21 5.3 Medium
A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.
CVE-2021-31323 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::parseDashProperty function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31322 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31321 1 Telegram 1 Telegram 2024-11-21 7.1 High
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the gray_split_cubic function of their custom fork of the rlottie library. A remote attacker might be able to overwrite Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31320 1 Telegram 1 Telegram 2024-11-21 7.1 High
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the VGradientCache::generateGradientColorTable function of their custom fork of the rlottie library. A remote attacker might be able to overwrite heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31319 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by an Integer Overflow in the LOTGradient::populate function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31318 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTCompLayerItem function of their custom fork of the rlottie library. A remote attacker might be able to access heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31317 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Type Confusion in the VDasher constructor of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's heap memory out-of-bounds on a victim device via a malicious animated sticker.
CVE-2021-31315 1 Telegram 1 Telegram 2024-11-21 5.5 Medium
Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the blit function of their custom fork of the rlottie library. A remote attacker might be able to access Telegram's stack memory out-of-bounds on a victim device via a malicious animated sticker.