CVE catalog

CVE-2021-36769

telegram-desktop: CVE-2021-36769

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.39% · Oct 25, 2026

A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantelegram-desktopsid5.7.2+ds-5fixed
Debiantelegram-desktopforky5.7.2+ds-5fixed
Debiantelegram-desktopbookworm4.6.5+ds-2fixed
Ubuntutelegram-desktop18.041.1.23-1vulnerable
Ubuntutelegram-desktop18.041.1.23-1build1vulnerable
Ubuntutelegram-desktop18.041.1.23-2vulnerable
Ubuntutelegram-desktop18.041.1.23-3vulnerable
Ubuntutelegram-desktop18.041.2.6-1vulnerable
Ubuntutelegram-desktop18.041.2.6-2vulnerable
Ubuntutelegram-desktop18.041.2.6-2build1vulnerable
Ubuntutelegram-desktop18.041.2.6-2build2vulnerable
Ubuntutelegram-desktop18.041.2.6-2build3vulnerable
Ubuntutelegram-desktop18.041.2.15-1vulnerable
Ubuntutelegram-desktop18.041.2.15-1build1vulnerable
Ubuntutelegram-desktop18.041.2.17-1vulnerable
Ubuntutelegram-desktop20.041.8.8-1vulnerable
Ubuntutelegram-desktop20.041.8.15-2vulnerable
Ubuntutelegram-desktop20.041.9.8~slim-1vulnerable
Ubuntutelegram-desktop20.041.9.14+ds-1vulnerable
Ubuntutelegram-desktop20.041.9.14+ds-2vulnerable
Ubuntutelegram-desktop20.041.9.21+ds-1vulnerable
Ubuntutelegram-desktop20.042.0.1+ds-1vulnerable
Ubuntutelegram-desktop20.042.0.1+ds-1build1vulnerable
Ubuntutelegram-desktop20.042.1.7+ds-2~ubuntu20.04.1vulnerable
Ubuntutelegram-desktop20.043.1.1+ds-1~ubuntu20.04.1vulnerable
Ubuntutelegram-desktop22.043.1.1+ds-1vulnerable
Ubuntutelegram-desktop22.043.5.2+ds-1vulnerable
Ubuntutelegram-desktop22.043.6.1+ds-2build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantelegram-desktopsourcesid2.9.2+ds-1not yet assignedNot reported[991493]
Debiantelegram-desktopsourceforky2.9.2+ds-1not yet assignedNot reported[991493]
Debiantelegram-desktopsourcebookworm2.9.2+ds-1not yet assignedNot reported[991493]

[Debian bug #991493]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [telegram-desktop]Fixed

    Source package: [telegram-desktop]

    Details (2)

    • 4.6.5+ds-2+b1 · amd64 · bookworm

      Fixed · Fixed: 2.9.2+ds-1

      dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

    • 4.6.5+ds-2+b1 · arm64 · bookworm

      Fixed · Fixed: 2.9.2+ds-1

      dsa · telegram-desktop · debian · bookworm; dsa · telegram-desktop · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]