CVE-2026-7701 — Telegram Desktop Null Pointer Dereference

title: CVE-2026-7701 - Telegram Desktop Null Pointer Dereference via URL Auth Box
id: scw-2026-05-03-ai-1
status: experimental
level: medium
description: |
  This rule detects the execution of Telegram Desktop with command line arguments that indicate the exploitation of CVE-2026-7701. The vulnerability lies in the RequestButton function within url_auth_box.cpp, where manipulation of the 'login_url' argument leads to a null pointer dereference. This detection focuses on the specific file path and a string indicative of the vulnerable function call within the command line, aiming to catch initial exploitation attempts.
author: SCW Feed Engine (AI-generated)
date: 2026-05-03
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7701/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Users\*\AppData\Roaming\Telegram Desktop\Telegram.exe'
      CommandLine|contains:
          - 'url_auth_box.cpp'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse