Vulnerability · Published Jul 23, 2024 · Assigned by ESET
CVE-2024-7014Improper multimedia file attachment validation in Telegram for Android app
High 7.1
In plain English
A high-severity improper input validation in Telegram for Android from Android. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
EvilVideo vulnerability allows sending malicious apps disguised as videos in Telegram for Android application affecting versions 10.14.4 and older.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Android | Telegram for Android | 0 – through 10.14.4 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H