CVE-2018-17231
** DISPUTED ** Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of...
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
- Record
CVE-2018-17231- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
- Record
CVE-2018-17231- Updated
- 2026-11-02
EUVDEUVD-2018-8991 No score
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
- Record
EUVD-2018-8991- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh6g-c662-cccm
** DISPUTED ** Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of...
** DISPUTED ** Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary.
- Record
GHSA-fh6g-c662-cccm- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
- Record
CVE-2018-17231- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-17231
Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
- Record
DEBIAN-CVE-2018-17231- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
telegram-desktopDebian:12 |
All versions, plus listed versions 4.10.3+ds-14.10.3+ds-24.11.5+ds-14.11.8+ds-14.13.1+ds-1 Show 16 moreShow less4.14.3+ds-14.14.4+ds-14.14.9+ds-14.14.9+ds-1.14.6.5+ds-24.8.1+ds-14.8.1+ds-24.8.1+ds-2~bpo11+14.8.1+ds-2~bpo12+14.9.3+ds-14.9.7+ds-15.7.2+ds-25.7.2+ds-2~bpo13+15.7.2+ds-35.7.2+ds-45.7.2+ds-5 |
None known |
telegram-desktopDebian:14 |
All versions, plus listed versions 1.0.14-11.0.29-11.1.0-11.1.10-11.1.18-1 Show 45 moreShow less1.1.19-11.1.19-21.1.23-11.1.23-1~bpo9+11.1.23-21.1.23-31.2.1-11.2.1-21.2.15-11.2.17-11.2.6-11.2.6-21.3.10-11.3.10-21.3.14-11.3.7-11.4.0-11.5.11-11.5.2-11.5.4-11.5.8-11.7.0-11.7.14-11.8.15-11.8.15-21.8.15-2~bpo10+11.8.2-11.8.2-21.8.4-11.8.8-11.9.14+ds-11.9.14+ds-21.9.21+ds-11.9.8~slim-12.0.1+ds-12.1.0+ds-12.1.4+ds-12.1.5+ds-12.1.7+ds-12.1.7+ds-22.2.0+ds-12.2.0+ds-22.2.0+ds-2~bpo10+12.2.0+ds-32.2.0+ds-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-17231 is a high vulnerability (CVSS 7.5) in Telegram Desktop, published September 19, 2018. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile.
References
Left out here: 70 versions. The JSON record has them.