CVE-2021-41861
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248.
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than CVE-2019-16248. After approximately two to four uses of the self-destruct feature, there is a misleading UI indication that an image was deleted (on both the sender and recipient sides). The images are still present in the /Storage/Emulated/0/Telegram/Telegram Image/ directory.
- CVSS 3.1
- 3.3 LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Affected
- telegram/telegram
- Source
- cve@mitre.org
References
- https://desktop.telegram.org/changelog#v-2-6-23-02-21Release Notes, Vendor Advisory
- https://habr.com/ru/post/580582/Third Party Advisory
- https://pikabu.ru/story/konfidentsialnost_polzovateley_telegram_snova_narushena_predstaviteli_messendzhera_trebuyut_ne_raskryivat_podrobnostey_8511495Third Party Advisory
- https://telegram.org/blog/autodelete-inv2/ru#avtomaticheskoe-udalenie-soobscheniiVendor Advisory
- https://desktop.telegram.org/changelog#v-2-6-23-02-21Release Notes, Vendor Advisory
- https://habr.com/ru/post/580582/Third Party Advisory
- https://pikabu.ru/story/konfidentsialnost_polzovateley_telegram_snova_narushena_predstaviteli_messendzhera_trebuyut_ne_raskryivat_podrobnostey_8511495Third Party Advisory
- https://telegram.org/blog/autodelete-inv2/ru#avtomaticheskoe-udalenie-soobscheniiVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.