CVE-2021-47793CWE-770

Telegram Desktop 2.9.2 - Denial of Service (PoC)

Medium · published January 15, 2026

CVSS v4.0
4.6
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

⚠️ A single oversized message can crash Telegram Desktop! All it takes is a crafty attacker sending a 9 million byte payload, and poof—your app goes down! Think of it like a restaurant serving dinner: if someone orders an absurdly massive portion that doesn't fit on the table, it can create a chaotic mess that halts service for everyone else. That's what this vulnerability does to Telegram! If exploited, an attacker could easily send oversized messages that crash Telegram Desktop, disrupting your communication and productivity. While it’s not catastrophic, repeatedly crashing the app could be downright annoying for users trying to stay connected.

Put simply

Think of it like a restaurant serving dinner: if someone orders an absurdly massive portion that doesn't fit on the table, it can create a chaotic mess that halts service for everyone else. That's what this vulnerability does to Telegram! This denial of service vulnerability in Telegram Desktop 2.9.2 allows attackers to crash the application by submitting an oversized message payload, consuming system resources in the process.

What to do

If exploited, an attacker could easily send oversized messages that crash Telegram Desktop, disrupting your communication and productivity. While it’s not catastrophic, repeatedly crashing the app could be downright annoying for users trying to stay connected. To protect against this vulnerability, users should update Telegram Desktop to the latest version that addresses this issue. Stay aware of app updates and consider limiting message sizes on the client-side as an additional precaution. You've got this! Simply update your app and you'll be back in the chat without any mess! 🛡️

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-01-15T23:25Z
EPSS history
Timeline
  • 15 JAN 23:25Z
    Telegram Desktop 2.9.2 - Denial of Service (PoC)
    cvelistv5