In short: On September 2, 2026, it emerged that Telegram Desktop versions 7.1.0 and 7.1.1 for Windows contained a critical bug: the spell-check library built a dictionary path using an empty prefix, and under certain directory conditions this resolved to C:\custom — causing a recursive deletion of everything inside. One user lost approximately 800 GB of projects, applications and personal files. The bug was present for about 66 hours before version 7.1.2 shipped the fix. Check your version and update immediately if needed.
What happened
On September 2, 2026, Anti-Malware.ru and other Russian-language tech media reported a serious bug in Telegram Desktop: versions 7.1.0 and 7.1.1, released on August 24–25, caused recursive file deletion under specific conditions. The issue was first documented by GitHub user "Sparebola" in the official tdesktop repository (issue #31170) — their machine, with Telegram installed under C:\custom\program\, lost all its data when the app applied an update. If you are concerned that your personal data may already be exposed elsewhere, our guide on how to check for a personal-data leak is a good starting point.
How the bug worked
The root cause was in Telegram's lib_spellcheck library, which handles in-app spell checking. During initialization, the code built a path to the dictionary folder by appending /custom to the working directory path. If the working directory was an empty string, the resolved path was not relative to the Telegram installation folder — it became the absolute system path C:\custom.
The function removeRecursively() then deleted the entire contents of that folder, expecting to find only a temporary dictionary file. For the affected user, C:\custom held installed applications, active work projects and personal files — approximately 800 GB — all permanently erased with no warning and no recycle-bin recovery possible.
Who was affected and the scale
Vulnerable versions 7.1.0 and 7.1.1 were in circulation for approximately 66 hours. The bug only triggered on Windows — Linux, macOS, Android and iOS users were not affected. The trigger condition: the folder C:\custom had to exist on disk at the time the application launched or applied its update.
No official count of affected users was published and Telegram did not send notifications. Given tens of millions of Telegram Desktop installations on Windows across Russia and neighbouring countries, even a small fraction of non-standard installations could translate into significant data loss across the user base.
What to do now
Check your Telegram Desktop version. Open the app, tap the hamburger menu → Settings, then scroll to the About section. If you see version 7.1.0 or 7.1.1, update immediately to 7.1.2 or later via Settings → Check for updates, or download the installer from the official Telegram website.
Inspect C:\custom on your drive. If that folder existed and was emptied, Windows Recycle Bin recovery will not help: removeRecursively() bypasses the recycle bin entirely. Data recovery tools such as Recuva, R-Studio, or TestDisk may retrieve files if the disk sectors have not been overwritten yet.
Set up regular backups. This incident illustrates that data loss can come from any direction — including a trusted application. The 3-2-1 rule: three copies of your data, on two different media types, with one copy stored off-site.
What this tells us about app security
The Telegram Desktop incident is a rare but instructive case: a bug in a legitimate, widely trusted application caused direct, irreversible harm to users without any malicious intent. It underscores several principles. First, updates can introduce regressions — monitor official channels (the @telegramdesktop Telegram channel or the tdesktop GitHub repository) in the first few days after a major release before applying it to machines with critical data. Second, applications have access to your file system — pay attention to where you install software. Third, backups remain the only absolute protection against data loss regardless of cause: bug, ransomware, or hardware failure.
Where does a VPN fit in?
A VPN does not protect against a bug inside an application — it covers a different layer of risk. When you connect on public Wi-Fi, your traffic can be intercepted by third parties. LiMP VPN encrypts the entire connection so even under a man-in-the-middle attack your data remains unreadable. This matters especially for sensitive messages and files you share through messaging apps. You can pick a plan on our pricing page. Treat a VPN as one layer of digital hygiene, alongside regular backups and attention to application version history.
Sources
This article is based on reporting by Anti-Malware.ru (September 2, 2026) and vc.ru (September 2, 2026), and the original bug report in the official Telegram Desktop repository at tdesktop/issues/31170.