CVE-2026-7701: Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference
A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/urlauthbox.cpp of the component Bot API. The manipulation of the argument loginurl leads to null pointer dereference. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. There is ongoing doubt regarding the real existence of this vulnerability. Upgrading to version 6.7.6 is able to resolve this issue. Upgrading the affected component is recommended. The vendor provides this rationale for the dispute: "[T]he described scenario does not lead to any security issue or vulnerability, and only causes a one-time crash. In the outlined scenario, the targeted user must perform an active action, which doesn't produce any consequences after the app is relaunched."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Telegram Desktopto a version that resolves this vulnerability.Fixed in 6.7.6 - Compensating control
Since the attack can be initiated remotely, restrict access to Telegram Desktop Bot API interactions (e.g., limit exposure of any interfaces/buttons that could be triggered remotely) until the client is upgraded.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7701?
CVE-2026-7701 has been classified with a severity rating that indicates it poses a potential risk to the security of Telegram Desktop users.
How do I fix CVE-2026-7701?
To fix CVE-2026-7701, users should update Telegram Desktop to version 6.7.6 or later.
What impact does CVE-2026-7701 have on Telegram Desktop?
CVE-2026-7701 could lead to a null pointer dereference in the Bot API, potentially resulting in application crashes.
Which versions of Telegram Desktop are affected by CVE-2026-7701?
CVE-2026-7701 affects all versions of Telegram Desktop up to and including 6.7.5.
Is there a workaround for CVE-2026-7701 prior to updating?
There currently are no known workarounds for CVE-2026-7701 and users are advised to update their software.