Telegram Android Flaw: The Call Concern And Possible Responses

🔍 Read the full analysis: Telegram Android Flaw: The Call Concern And Possible Responses on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a memory bug in Telegram’s Android voice-call code on October 29, saying it could help an attacker take control of a phone after the user answered a call. The company says Telegram Android 12.10.4, released in September, contains the fix; it also says it has seen no real-world attacks. The reported full attack depends on two additional bugs whose details have not been published.

NebuSec said the affected range was Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The startup described the issue as a memory bug in call handling. According to chief executive Eten Zou, the bug alone was not enough to take over a device: it had to be combined with a second flaw that leaked information and a third Android exploit that provided root, or administrator-level, access.

Zou told The Hacker News that the chain was tested in private voice calls on ARM64 phones. NebuSec’s short demonstration video shows a call connecting before the victim phone displays a takeover message. The video does not identify the Telegram or Android version on the device, and it does not publicly document the other two flaws. NebuSec said an ordinary Telegram account was sufficient for the attacker.

A comparison of Telegram’s published Android source code for versions 12.10.3 and 12.10.4 shows a change in the handling of a call status message known as MediaState. In the earlier code, the app checked that a camera-rotation value was present but then read a different field; the later code reads the rotation value. That code change supports the existence of a correction, but does not independently establish that the complete attack chain works as described.

What the Call Flaw Could Enable

If NebuSec’s account is accurate, the issue matters because answering an unexpected call could serve as the user action that starts a larger attack. The company characterized the scenario as one-click, not zero-click: the victim would have to answer. Zou said the final stage could provide access to phone content and sensors, including messages, microphone and camera, but those consequences rely on the additional exploits NebuSec described.

For users, the immediate practical step is to update Telegram for Android and confirm that the app is version 12.10.4 or later. Until updated, NebuSec recommends limiting who can call through the app’s privacy setting and declining calls from unknown people. For organizations, the report also illustrates a monitoring gap: if no CVE is assigned, security systems that rely only on CVE tracking may not flag the issue. Companies can set minimum app versions for work phones and define rules for messenger use.

Popular right now

Ninja Foodi 10-Quart DualZone 6-in-1 Air Fryer, Black, DZ302

AmazonView Latest Price

Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black

AmazonView Latest Price

Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Fix Reached Android

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 became available. Zou said Telegram acknowledged the report but did not agree that the bug could be used for remote code execution. He also said no CVE was assigned and no bounty was paid. The source article reported no public response from Telegram as of October 29.

Telegram’s shared call library, tgcalls, received a correction titled “Fix camera rotation” on April 21, 2026, according to the source-code review described in the report. The Android source containing the change appeared later. The Hacker News reported that iOS included the change in May and desktop in July, but the source material does not establish that those versions were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the flaw had no CVE number in the U.S. National Vulnerability Database, and the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog had no Telegram entry. Those absences describe the public records checked at that time; they do not prove that no exploitation occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What Has Not Been Verified

The full chain remains largely dependent on NebuSec’s account. The company had not published a technical write-up of the flaw as of October 29, and its demonstration did not show the affected software versions. The source report says the underlying call-code correction can be seen in Telegram’s public Android code, but the author could not verify the two additional bugs, test the complete chain on a current, fully patched Android phone, or determine whether the chain had been used before disclosure.

NebuSec said it had seen no real attacks. That is the company’s reported finding, not proof that the flaw was never exploited. It is also unclear whether older code in other Telegram apps could be abused, whether Telegram will publish its own security advisory, or why it treated the earlier shared-library change as a camera correction rather than a security issue.

Updates and Technical Disclosure

Android users should check Telegram’s version in Settings and update to 12.10.4 or later, or restrict incoming calls until they can update. Organizations may want to verify app versions on managed devices rather than rely solely on vulnerability databases for notice of this issue.

The next useful developments would be a Telegram statement, a technical report from NebuSec, or independent testing of the complete chain and its affected versions. Until then, the fix in Android 12.10.4 is visible in the source code, while the reported takeover scenario and any history of exploitation remain unconfirmed beyond the company’s claims.

Key Questions

What is the reported Telegram Android flaw?

NebuSec described a memory bug in Telegram’s Android call code. The company says it could be combined with two other flaws to take control of a phone after the user answered a call.

Which Telegram version contains the fix?

NebuSec identified Telegram Android 12.10.4 as fixed. The reported affected range is versions 8.6.2 through 12.10.3. Users should check Settings and update to 12.10.4 or later.

Did the attack work without the user answering?

No. NebuSec described the reported scenario as one-click, because the user had to answer the incoming call. It was not described as a zero-click attack.

Is there evidence the flaw was used in real attacks?

NebuSec said it had seen no real attacks. The available information does not independently establish whether the flaw was ever exploited.

Are Telegram on iPhone and desktop affected?

NebuSec said it had no evidence that the iOS or desktop apps, or group calls, were directly affected. The source report noted code changes in other clients but said exploitability there has not been shown.

Source: ThorstenMeyerAI.com