Telegram’s Android Flaw: The Reported Call Risk In Context

🔍 Read the full analysis: Telegram’s Android Flaw: The Reported Call Risk In Context on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying an attacker could use it as part of a chain of vulnerabilities to take control of a phone after the user answered a call. Telegram’s Android version 12.10.4, released in late September, contains the reported correction, but the full attack chain has not been detailed in a public technical write-up.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. According to the company’s chief executive, Eten Zou, the call bug was not sufficient by itself: it was combined with a second bug that leaked information and a third vulnerability that provided Android root access. Root access means administrator-level control of a device. NebuSec says the chain could give an attacker access to information and functions including messages, the microphone and the camera.

The company says the attack required the user to answer an incoming call, making it a one-click scenario rather than a zero-click attack. NebuSec says it tested the chain in private voice calls on ARM64 phones, a processor architecture used by most modern Android devices, and that an attacker needed only a regular Telegram account. Its brief demonstration video shows a call connecting before the victim phone returns to its home screen. The video does not identify the Telegram or Android versions used.

A comparison of Telegram’s publicly available Android source code for versions 12.10.3 and 12.10.4 shows a change in the handling of a call message, according to the source material. The earlier code checked that a camera-rotation value existed but then read a separate video-state field that might be absent. The later code reads the rotation field. That change is consistent with the reported flaw, but it does not independently verify NebuSec’s claims about the two additional bugs or the complete takeover chain.

Why Answered Calls Can Carry Risk

Voice calls are designed to receive information from another account before a user has chosen to trust the caller. A defect in how call data is processed can therefore give an attacker a route into software running on the recipient’s device. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take”; that observation helps explain why a vulnerability triggered by answering differs from one requiring a victim to install an app or open a file.

For users, the immediate step is to update Telegram for Android and check that the installed version is 12.10.4 or later. Until updated, NebuSec’s source recommends restricting who can call an account to contacts or nobody, and declining calls from unknown people. For organizations, the case also highlights a visibility problem: a security fix without a CVE identifier may not appear in tools that rely on CVE tracking. Companies may need to enforce minimum app versions on work phones and set policies for messaging apps.

The claims warrant attention but should not be treated as proof of widespread compromise. NebuSec says it has no evidence of real-world attacks. That is the company’s assessment, not confirmation that exploitation never occurred, and the public information available does not establish whether any users were affected.

Products Worth Considering

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec says it reported the issue to Telegram on September 26, shortly after version 12.10.4 became available. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution, or running an attacker’s code on a device. According to Zou, no CVE was assigned and no bug bounty was paid. The source material says no public response from Telegram was located.

The source code history offers additional timing. Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the fix appeared later, on September 24, according to the source material. The Hacker News reported that iOS included the change in May and the desktop app in July. The existence of a shared-code correction does not establish that those apps were vulnerable to the same attack; NebuSec has not shown that iOS, desktop or group calls were directly affected.

As of October 29, the flaw had no CVE number, was not listed in the U.S. National Vulnerability Database under a CVE, and did not appear in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog dated October 28. Those absences describe the public records checked in the source material; they do not prove that the flaw was harmless or never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the flaw

What the Public Evidence Cannot Confirm

The technical basis for the full attack remains partly unverified publicly. NebuSec has not published a detailed write-up of the two additional vulnerabilities, and the demonstration video does not show the software versions involved. The reported source-code change supports the existence of a defect in call-message handling, but it does not establish that the complete chain worked as described across all affected devices.

It is also unclear whether the chain works against a fully updated Android operating system, whether anyone exploited the flaw before disclosure, and whether related Telegram apps or group calls were vulnerable. NebuSec says it has seen no real attacks, but that does not rule out activity it did not detect. No public CVE record or exploitation listing was available as of October 29.

Updates and Further Technical Details

Android users should check Telegram’s version in the app settings and install 12.10.4 or a later release if they have not already done so. Users who cannot update immediately can restrict incoming calls and avoid answering calls from unknown accounts, according to the mitigation advice in the source material.

The next useful developments would be a detailed technical account from NebuSec, a public response from Telegram, and clarification about the other two vulnerabilities and the devices they affect. Until that information is available, the reported call-code defect and its fix can be described separately from the company’s broader claim that the chain enabled full device control.

Key Questions

What is the reported Telegram Android flaw?

NebuSec reported a defect in Telegram’s Android voice-call code that mishandled a field in call-related data. The company says the bug could be combined with two other vulnerabilities to take over a phone after a user answered a call.

Which Telegram version fixes the reported issue?

The reported correction is in Telegram for Android 12.10.4, released in late September 2026. Users should install that version or a later one.

Did the flaw affect every Telegram app?

NebuSec identified Android versions 8.6.2 through 12.10.3. The source material says the company has not shown that iOS, desktop or group calls were directly affected, even though related call code was updated in other clients.

Were attacks reported in the wild?

NebuSec says it has seen no real-world attacks. That is not proof that exploitation never occurred, and the public material does not establish whether any users were affected.

What should users do now?

Update Telegram for Android to version 12.10.4 or later. If an update is not immediately possible, restrict who can call you and decline calls from unfamiliar accounts, following the mitigation advice in the source material.

Source: ThorstenMeyerAI.com