This vulnerability affects Telegram Desktop (up to version 6.7.5) in the Bot API component, specifically in the RequestButton function of the url_auth_box.cpp source file. An attacker can remotely cause a null pointer dereference by manipulating the login_url argument, potentially leading to application crashes or denial of service. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. There is no official patch or remediation available, and the vendor has not responded to the disclosure.

Exploitation of this vulnerability can cause Telegram Desktop to crash due to null pointer dereference, resulting in denial of service for affected users. There is no indication of privilege escalation, data disclosure, or code execution from the provided information. The vulnerability can be triggered remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is available and the vendor has not responded, users should exercise caution when interacting with untrusted bots or links that may exploit the login_url parameter. Monitoring for vendor updates is recommended.