A Plain-Language Look At Telegram’s Android Call Flaw

🔍 Read the full analysis: A Plain-Language Look At Telegram’s Android Call Flaw on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed an Android flaw in Telegram’s voice-call code on October 29, saying it could be combined with two other bugs to take control of a phone after a user answered an incoming call. Telegram for Android version 12.10.4 contains the reported fix, which was released in late September; NebuSec says it has seen no real-world attacks.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call bug was not enough by itself: an attacker allegedly had to combine it with a second bug that leaked information and a third vulnerability that could give Android root, or administrator, access. If the full chain worked, NebuSec said, an attacker could gain control of the phone, including access to messages, the microphone and the camera.

The company said the attack required a victim to answer a Telegram call, making it a one-click scenario rather than an attack that needed no action from the user. NebuSec reported testing the chain in private voice calls on ARM64 phones. Its 22-second demonstration video shows a call connecting before the victim phone returns to its home screen, but does not identify the Telegram or Android versions used. The video does not independently establish how the full exploit chain works.

A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 found a change to how call messages handle a video-rotation value. In the earlier code, the program checked that one field was present but then read a different field that a message did not have to include. The later version reads the rotation field. That source-code change supports the existence of a code defect, but does not by itself verify NebuSec’s claim that it could be combined with the other bugs to take over a phone.

Why Answering a Call Matters

Calls arrive from people a user may not know, and answering one is an ordinary action. That makes a flaw in call-handling code a concern beyond people who click suspicious links: if NebuSec’s account is accurate, the trigger was accepting an incoming call, followed by a chain of vulnerabilities that could cross from the app into Android itself.

For users, the practical step is to update Telegram for Android to version 12.10.4 or later and check the app’s version in Settings. Until updated, NebuSec’s guidance is to restrict who can call through Telegram’s privacy settings to My Contacts or Nobody, and to decline calls from unknown people. Those steps reduce exposure to calls, but the source material does not establish that they address every part of the claimed exploit chain.

The case also illustrates a challenge for employers and security teams. The flaw has no CVE identifier, according to the report, so tools that rely only on CVE listings may not flag it. Organizations managing work phones may need to set minimum app versions and apply messenger policies rather than relying on vulnerability databases alone.

Products Worth Considering

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec said it reported the flaw to Telegram on September 26, 2026, shortly after version 12.10.4 was released. Zou told The Hacker News that Telegram acknowledged the report but did not think the bug could be turned into remote code execution, meaning an attacker running their own code on a victim’s device. Zou also said no CVE was assigned and no bounty was paid. Those details come from Zou; Telegram had not issued a public statement in the material available for this report.

The public code history provides a separate timeline. Telegram’s shared call library, tgcalls, received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the change appeared later, on September 24, according to the report’s examination. The report says the iOS app incorporated the change in May and the desktop app in July, citing The Hacker News. The shared code change does not establish that those apps were exploitable.

The source code describes call messages that communicate information such as whether a microphone is muted, a camera is on and how video is rotated. The reported Android defect involved reading the wrong field in one of those messages. The U.S. National Vulnerability Database had no CVE entry for the issue as of October 29, and the October 28 version of the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog had no Telegram entry.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Exploit Details Remain Unverified

The existence of a code change is supported by Telegram’s published Android source, but the full claimed takeover chain has not been independently demonstrated in the material available. NebuSec had not published a technical write-up as of October 29. Its short video does not show the exact software versions or explain the two additional bugs, and the source material says those bugs could not be checked independently.

It is also unclear whether the chain works against a current, fully patched Android device, whether anyone exploited the flaw before disclosure, or whether versions of Telegram for iOS or desktop were directly vulnerable. NebuSec said it had seen no real attacks; that is not proof that none occurred. The report also says the company had not shown that group calls were affected. There was no CVE entry or listing in the U.S. catalog of known exploited vulnerabilities as of the dates checked, but those absences do not settle whether the flaw was used.

Update Android and Watch for Details

Android users should install Telegram version 12.10.4 or later and verify the installed version in Settings. People who cannot update immediately can limit incoming calls to contacts or disable them in Telegram’s call-privacy settings, as NebuSec recommends. Users should check for later app updates through their usual trusted update channel.

The next useful evidence would be a technical account from NebuSec describing the full chain, or a public response from Telegram explaining its assessment and the scope of the fix. Until then, the code defect and the version containing its correction can be checked against public source, while the claimed full-device compromise, affected platforms and any prior exploitation remain unconfirmed.

Key Questions

Which Telegram Android versions did NebuSec say were affected?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the issue was fixed in version 12.10.4. The source material does not establish whether other platforms were vulnerable.

Did answering a call alone give an attacker control of a phone?

NebuSec said answering a call was the user action needed, but also said the call flaw had to be combined with two other bugs to reach full control. The complete chain has not been independently verified in the material available.

Have attackers used the flaw?

NebuSec said it had seen no real-world attacks. Whether the flaw was used by anyone before disclosure remains unknown.

What should Telegram users do?

Update Telegram for Android to version 12.10.4 or later and confirm the installed version in Settings. If an update is not yet possible, NebuSec advises limiting calls to contacts or setting calls to Nobody.

Was Telegram’s iPhone or desktop app affected?

The report says the same correction appeared in shared call code and later in iOS and desktop releases, but direct exploitability on those platforms has not been shown. NebuSec reported no evidence that they were directly affected.

Source: ThorstenMeyerAI.com