CVE-2019-10044 Other in n/a

High 8.8 Published 25 Mar 2019 Updated 4 Aug 2024

Telegram Desktop and mobile apps allow IDN homograph attacks, enabling users to be tricked into visiting malicious URLs disguised as legitimate ones.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-10044?

CVE-2019-10044 is a high-severity vulnerability in n/a, published on 25 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Which versions are affected by CVE-2019-10044?

It affects 2 products.

Products include Telegram Telegram, Telegram Telegram Desktop.

How do I fix CVE-2019-10044?

Upgrade to a fixed version.

Is CVE-2019-10044 being exploited?

There is no known exploitation of CVE-2019-10044 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-10044, GHSA-9gmh-43p9-37g6, UBUNTU-CVE-2019-10044.