CVE-2019-10044

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-25 · updated 2026-06-17

Description

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Affected products

Telegram: all versions
Telegram Desktop: before 1.5.12 — fixed in 1.5.12

How to fix

Upgrade to a fixed version: Telegram Desktop 1.5.12. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/107610
https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt
http://www.securityfocus.com/bid/107610
https://github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt

Get alerted when CVE-2019-10044 or the next vulnerability affects your stack