What Is Known About Telegram’s Android Call-Related Flaw?

🔍 Read the full analysis: What Is Known About Telegram’s Android Call-Related Flaw? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying an attacker could use it as part of a chain of bugs to gain control of a phone after the user answered a call. Telegram’s Android version 12.10.4, released in September, contains a code correction matching the reported flaw, but the full attack chain has not been independently verified in public.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026, and was fixed in version 12.10.4. The company describes the issue as a memory bug in the app’s call-handling code. According to NebuSec chief executive Eten Zou, the flaw by itself was not enough to take over a phone: an attacker also needed a second bug to escape the Telegram app into Android and a third vulnerability that provided root, or administrator-level, access.

NebuSec says its demonstration involved private voice calls on ARM64 Android phones, a chip architecture used by most modern Android devices. It says an attacker needed an ordinary Telegram account and that the victim had to answer the call. That makes the described attack one-click, not zero-click: the person would have to take an action. NebuSec said it had seen no real-world attacks. Its short demo video shows a call connecting and the target phone returning to its home screen, but it does not identify the Telegram or Android versions used.

A review of Telegram’s public Android source code found that versions 12.10.3 and 12.10.4 differ in the call code associated with the reported issue. In the earlier version, the program checked that one field in a call-status message was present, then read a different field that the message was not required to include. In 12.10.4, the code reads the field it checked. This code comparison supports the existence of a change in the relevant area, but does not establish that the complete attack chain works as NebuSec described.

Why Answered Calls Matter

The reported flaw matters because calls require an app to process information from another account, including one the recipient may not know. If NebuSec’s account is accurate, answering a call could have served as the entry point for a chain that moved from Telegram into the Android operating system and then gained broad access to the device. That is a serious potential consequence, but the public evidence does not establish that the complete chain was successfully used against people outside testing.

For users, the immediate practical point is to check that Telegram for Android is version 12.10.4 or later. Until updated, NebuSec’s reported precautions include limiting who can call the account to contacts or nobody, and declining calls from unknown people. These steps reduce exposure to the described call-based scenario; they do not prove that other vulnerabilities or attack routes are addressed.

The report also highlights a gap for organizations that track security updates through vulnerability identifiers. As of October 29, the source material says the flaw had no CVE number and was not listed in the U.S. catalog of known exploited vulnerabilities. Teams relying only on CVE alerts may not see it in those systems, so minimum app-version rules for work phones and clear messaging-app policies can matter even when a formal vulnerability listing is absent.

Products Worth Considering

Trezor Safe 7 Crypto Hardware Wallet

AmazonView Latest Price

Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A Fix Before Public Disclosure

NebuSec announced the issue on October 29, saying in a post on X that the bug was fixed in Telegram Android 12.10.4 (7099). Zou told The Hacker News that NebuSec reported the flaw to Telegram on September 26, shortly after the fixed version appeared. According to Zou, Telegram acknowledged the report but did not consider the bug capable of remote code execution, and no bounty was paid. The source material reports no public response from Telegram as of October 29.

The version history adds complexity. Telegram’s shared call library, which is used across its apps, received a correction on April 21, 2026, in a change described as “Fix camera rotation.” The Android source containing the fix appeared later, in September. The source material says The Hacker News reported that iOS included the change in May and desktop in July, but it does not show that the older code in those apps was exploitable. NebuSec has not established direct impact on iOS, desktop, or group calls.

The source material also reports that the U.S. National Vulnerability Database had no CVE entry for the issue as of October 29, and that the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry. Those absences describe the public records checked; they do not prove that the flaw was never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Limits of the Public Evidence

The complete exploit has not been laid out in a public technical report in the source material. The evidence for the two additional bugs and for the full chain rests on NebuSec’s statements and short demonstration video; the video does not show the software versions involved. The source material says the underlying Android code change can be inspected, but that does not verify the other vulnerabilities or prove that they can be combined on a current, fully patched device.

It is also unknown whether anyone used the flaw before NebuSec’s disclosure. The company says it has seen no real attacks, which is not the same as establishing that none occurred. The source material does not confirm whether Telegram has issued a public advisory, whether all affected users have updated, or whether the older versions of the shared call code created equivalent risk in iOS or desktop apps.

Update and Watch for Advisories

Android users can check Telegram’s version in the app’s settings and update to 12.10.4 or later if they have not already done so. Before updating, users can narrow call access to contacts or nobody and avoid answering calls from unfamiliar accounts. Organizations should confirm app versions on managed phones rather than relying only on CVE feeds, since this report had no CVE entry at the time described.

The next useful developments would be a detailed technical report from NebuSec, a public explanation from Telegram, or independent analysis confirming the full exploit chain and its device requirements. Until then, the reported impact should be treated as a serious but not fully verified security claim, and NebuSec’s statement that it saw no attacks should not be read as proof that the flaw was never used.

Key Questions

What was the reported Telegram flaw?

NebuSec described a memory bug in Telegram’s Android call code. It said the flaw could be combined with two other bugs to move beyond the app and take control of a phone.

Did an attacker need the user to answer the call?

Yes, according to NebuSec’s account. The user had to answer, making the reported method one-click rather than zero-click.

Which Telegram version contains the reported fix?

NebuSec said the issue was fixed in Telegram for Android 12.10.4. The source material recommends checking that the installed version is 12.10.4 or later.

Is there evidence the flaw was used in real attacks?

NebuSec said it had seen no real-world attacks. The public material described here does not establish whether the flaw was ever exploited by others.

Were Telegram’s iPhone and desktop apps affected?

Direct impact on iOS and desktop apps has not been shown. The source material says those apps received a related code correction, but does not establish that their earlier code was exploitable.

Source: ThorstenMeyerAI.com