Vulnerability in Microsoft Windows
CVE-2019-10044
Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.033 (88.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 88.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.033 · newest: 0.033 · change: 0.000
Affected products
References
- github.com/blazeinfosec/advisories/blob/master/telegram-advisory.txt (Exploit, Third Party Advisory)
- www.securityfocus.com/bid/107610 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2019-10044?
- CVE-2019-10044 is a high-severity vulnerability in Microsoft Windows. CVSS score: 8.8/10. Published 2019-03-25.
- How severe is CVE-2019-10044?
- High severity. CVSS v3 base score is 8.8 out of 10.