CVE-2018-3986

An exploitable information disclosure vulnerability exists in the "Secret Chats" functionality of the Telegram Android messaging application version 4.9.0. The "Secret Chats" functionality allows a user to delete all traces of a chat, either by using a time trigger or by direct request. There is a bug in this functionality that leaves behind photos taken and shared on the secret chats, even after the chats are deleted. These photos will be stored in the device and accessible to all applications installed on the Android device.

• CWE-200

• http://www.securityfocus.com/bid/106295Broken Link, Third Party Advisory, VDB Entry
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0654Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/106295Broken Link, Third Party Advisory, VDB Entry
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0654Exploit, Third Party Advisory

Published

Jan 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-3980An exploitable out-of-bounds write exists in the TIFF-parsin…7.8
• CVE-2018-3981An exploitable out-of-bounds write exists in the TIFF-parsin…7.8
• CVE-2018-3982An exploitable arbitrary write vulnerability exists in the W…7.8
• CVE-2018-3983An exploitable uninitialized pointer vulnerability exists in…7.8
• CVE-2018-3984An exploitable uninitialized length vulnerability exists wit…7.8
• CVE-2018-3985An exploitable double free vulnerability exists in the mdnsc…9.8
• CVE-2018-3987An exploitable information disclosure vulnerability exists i…5.5
• CVE-2018-3988Signal Messenger for Android 4.24.8 may expose private infor…4.7
• CVE-2018-3989An exploitable kernel memory disclosure vulnerability exists…4.3
• CVE-2018-3990An exploitable pool corruption vulnerability exists in the 0…9.3
• CVE-2018-3991An exploitable heap overflow vulnerability exists in the Wkb…10
• CVE-2018-3992An exploitable use-after-free vulnerability exists in the Ja…8.8