IPC Record Injection

Definition

IPC record injection exploits improper neutralization of record delimiters (e.g. semicolons) in inter-process communication between a desktop app’s single-instance handler and privileged helpers—allowing attacker-controlled fields to spawn extra commands.

Key Points

• CVE-2026-107181: telegram-desktop before 7.2.9 — crafted tg:// links inject OPEN: records on the single-instance socket, reaching legacy interpret: file-send path and exfiltrating local files (including tdata session data) to an attacker chat (2026-10-10-telegram-desktop-cve-account-takeover)
• Severity: CVSS 3.1 8.1 High; CVSS 4.0 8.6 (VulnCheck CNA)
• Fix: Commit db3405699f — escape separators, remove interpret: helper, harden mixed URL/local-path connections; shipped in 7.2.9 (Sept 2026) without prominent vendor advisory
• Mitigation: Upgrade to 7.2.9+; links opened inside Telegram in-process are not affected

Related

• telegram-desktop
• zero-day-vulnerabilities
• mobile-security

Sources

• 2026-10-10-telegram-desktop-cve-account-takeover