Telegram’s Android Flaw: A Look At The Call And The Response

🔍 Read the full analysis: Telegram’s Android Flaw: A Look At The Call And The Response on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying it could be combined with two other bugs to give an attacker control of a phone after a user answered a call. Telegram had already included a fix in Android version 12.10.4, released in September, according to NebuSec; the company says it has seen no real-world attacks.

NebuSec said the issue affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The flaw involved the app’s handling of data during voice calls. NebuSec chief executive Eten Zou told The Hacker News that the call-code bug was not sufficient on its own: it allegedly worked with a separate information-leak bug and an Android root exploit, which could provide full administrator control of a device.

NebuSec said the attacker needed a Telegram account and that the user had to answer a private voice call. That makes the described attack one-click, not zero-click. The company said it tested the chain on private calls using ARM64 phones, a chip design used in most modern Android phones. It has not publicly released a technical write-up, and the short demonstration video it posted does not identify the Telegram or Android versions running on the victim phone.

The source material reports that Telegram’s Android source code is publicly available and that a comparison of versions 12.10.3 and 12.10.4 showed a change to the handling of a camera-rotation value in call status messages. In the earlier code, the app checked that one field existed but read a different field; the newer code reads the rotation field. NebuSec reported the issue to Telegram on September 26, after the fixed version had appeared. Zou said Telegram acknowledged the report but did not agree that the bug could be used for remote code execution. No CVE was assigned, and Zou said no bounty was paid.

Why Answered Calls Matter

The reported flaw matters because answering a call is an ordinary action, while call software must process data from the person calling. If NebuSec’s account of the full chain is accurate, an attacker could use that routine interaction as the entry point to reach information and functions beyond Telegram, including messages, the microphone and the camera. Those consequences are claims by NebuSec, not independently established findings in a published technical report.

For users, the clearest practical step is to update Telegram for Android and confirm the installed version is 12.10.4 or later. Until updated, NebuSec’s guidance is to limit who can call through the app’s privacy settings and decline calls from strangers. For organizations, the lack of a CVE may make the issue harder to track in security systems that rely on vulnerability identifiers. Minimum app-version rules and messenger policies can help address that gap.

The disclosure also illustrates why a fix alone does not settle the security picture. The reported Android correction is public in the app’s source code, but the alleged supporting bugs, the attack conditions and any prior exploitation are not documented in a public technical account. Readers should distinguish the visible code change from NebuSec’s broader claims about what an attacker could achieve.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Apple Watch Series 12 GPS Smartwatch, 46mm

AmazonView Latest Price

Logitech MX Mechanical Wireless Illuminated Performance Keyboard – Clicky

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Fix Reached Android

NebuSec announced the flaw on X on October 29 and said it was fixed in Telegram Android 12.10.4 (7099). The source material says the Android source containing the correction appeared on September 24, while version 12.10.3 had been published on September 17. NebuSec’s report to Telegram came two days after the reported fixed version appeared.

The account also describes an earlier change in Telegram’s shared calling library, tgcalls. That library received a correction on April 21, 2026, titled “Fix camera rotation”; the Android source with the correction appeared 156 days later, according to the source material. The Hacker News reported that iOS incorporated the change in May and desktop in July. The source material does not establish that those versions were exploitable, and NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the U.S. National Vulnerability Database listed no CVE for the flaw, and the October 28 version of the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog had no Telegram entry. Those absences show that the issue was not listed there at that time; they do not prove that no attack occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Disclosure Does Not Show

The full attack chain remains unverified in a public technical write-up. NebuSec’s demonstration shows two phones and a claimed compromise, but does not reveal the software versions involved or provide enough detail to independently assess the two additional bugs. The source material says the Android call-code issue could be checked against Telegram’s public source; it does not say the other parts of the chain could be independently tested.

It is also unclear whether the complete chain works against a current, fully patched Android device, whether anyone used the flaw before its disclosure, or how many users may have been exposed. NebuSec reported no attacks it had observed, which is not proof that the flaw was never exploited. Telegram’s public position, the reason the shared-library correction reached Android later, and whether other Telegram platforms were affected have not been established in the material provided.

Update and Watch for Details

Android users should check Telegram’s version in Settings and install version 12.10.4 or later if an update is available. Anyone unable to update immediately can restrict incoming calls to contacts or disable them, and avoid answering calls from unknown accounts. Those steps address exposure to the described call-based entry point, but do not verify or resolve the alleged supporting vulnerabilities.

The next meaningful development would be a detailed technical account from NebuSec or a public response from Telegram explaining its assessment and the fix. Until then, the scope and exploitability claims should be treated as attributed statements from NebuSec. Organizations may also need to check whether their mobile-device controls can identify and enforce a minimum Telegram version without relying on a CVE entry.

Key Questions

What was the Telegram Android flaw?

NebuSec described a memory-handling bug in Telegram’s Android calling code. It said the flaw could be combined with two other bugs to gain control of a phone after a user answered a call. The full chain has not been documented in a public technical write-up.

Which Telegram versions did NebuSec say were affected?

NebuSec said Telegram for Android versions 8.6.2 through 12.10.3 were affected. It identified version 12.10.4 as containing the fix.

Does answering a call automatically hack a phone?

No such conclusion is established. NebuSec said an attacker needed to combine the call-code flaw with two other bugs, and that the user had to answer a private call. The reported attack chain has not been independently detailed in public.

Were attacks observed, and are iPhones affected?

NebuSec said it had seen no real-world attacks. It also said it had no evidence that iOS or desktop apps, or group calls, were directly affected. Those statements do not establish that exploitation never happened or settle whether other platforms could be vulnerable.

Source: ThorstenMeyerAI.com