Telegram Desktop 2.9.2 contains a resource exhaustion vulnerability that allows an attacker to crash the application by injecting an oversized message payload into the messaging interface.

This is a resource exhaustion flaw (CWE-770) occurring within the messaging interface. An attacker can trigger a crash by pasting a 9 million byte buffer into the input field, which forces the application to allocate excessive resources without proper limits or throttling.

Successful exploitation results in a denial of service for the end user, rendering the application unusable until it is manually restarted. While the CVSS score of 7.5 indicates a high severity rating, the impact is primarily localized to the individual client application, causing disruption to communication workflows and potential loss of unsaved draft data.

Immediate Action: Users should update the Telegram Desktop application to the latest available version provided by the official Telegram website to ensure all known stability and security patches are applied.

Proactive Monitoring: Security teams should monitor endpoint logs for repeated application crashes or unusual memory spikes associated with the Telegram process.

Compensating Controls: Ensure that endpoint protection software is configured to detect and block suspicious clipboard activities or automated injection of large data strings into application input fields.

Public Exploit Available: Yes, a proof-of-concept for this vulnerability is documented in the Exploit Database (EDB-ID: 50247).

The presence of a publicly available proof-of-concept necessitates prompt attention to this vulnerability. Organizations using Telegram Desktop in business environments should prioritize updating all client installations to the latest version to prevent potential disruption caused by this denial of service flaw.