CVE-2018-17780: Telegram Desktop

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addresses during a call because of an unsafe default behavior in which P2P connections are accepted from clients outside of the My Contacts list.

Affected products

• Telegram Telegram Desktop: version 1.3.14 only
• Telegram Telegram Messenger: version 3.3.0.0 only

Published 2018-09-29. Last modified 2026-06-17.