TDLib public change; vector-overflow fix mapping unconfirmed

F-TELEGRAM-VECOVF-001

Public snapshot: 26 Sep 2026. Status, releases and attribution belong to each source below; none is inferred from another record.

Recorded evidence

—score not recorded

tdlib/tdFixed before reporttdlib/td

TDLib public change; vector-overflow fix mapping unconfirmed

fix mapping unconfirmednot counted

details

Finding IDs: F-TELEGRAM-VECOVF-001
Status: fix mapping unconfirmed
Note: review on 2026-09-21 found that the cited commit changes PhotoSizeSource fatal logging, not vector-length validation. the earlier claim that this commit fixed the reported vector overflow before submission is withdrawn; this row is retained as an uncounted historical record pending a correct source.

F-TELEGRAM-VECOVF-001: Needs source detail. The cited logging change does not implement the claimed vector-length check. Reviewed 24 Sep 2026. Mechanism assessed by 1seal.

Mechanism source for F-TELEGRAM-VECOVF-001

Security area (1seal assessment): Unclassified. The cited commit changes fatal logging for PhotoSizeSource; it does not implement the claimed vector-length check. The previous fix mapping is unsupported by that source. Reviewed 24 Sep 2026.

Clarify or correct this record privately. The email subject includes the finding ID. For an existing case, continue the agreed private thread. Do not post unpublished vulnerability details in public issues. Research disclosure policy.

How this page groups evidence

This identifier groups recorded evidence; it is not an additional CVE, independent-vulnerability count or guarantee of vendor confirmation. Fixed code, released versions, attribution and independent discovery are distinct claims. Absent metadata means not recorded, not disproved. Counting rules.