PT-2026-36705 · Telegram · Telegram Desktop

Oblivionsage · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7701

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Telegram Desktop versions prior to 6.7.6

Description A null pointer dereference (a condition where a program attempts to read from a memory address that is null, typically causing a crash) can be triggered remotely in the Bot API component. The issue exists within the RequestButton() function located in the Telegram/SourceFiles/boxes/url auth box.cpp file, specifically through the manipulation of the login url argument.

Recommendations Update to a version newer than 6.7.5. As a temporary workaround, restrict the use of the RequestButton() function in the Bot API component.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

CVE-2026-7701

Affected Products

Telegram Desktop

References · 8

• 🔥 https://youtube.com/watch?v=xo9Bplsy1K8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7701 · Security Note
• https://vuldb.com/vuln/360870 · Note
• https://twitter.com/VulmonFeeds/status/2050991405242212840 · Twitter Post
• https://t.me/cveNotify/161937 · Telegram Post
• https://vuldb.com/vuln/360870/cti · Note
• https://vuldb.com/submit/804341 · Note
• https://t.me/CVEtracker/52580 · Telegram Post