Telegram’s Call-Related Android Flaw: What We Know Today

🔍 Read the full analysis: Telegram’s Call-Related Android Flaw: What We Know Today on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a memory bug in Telegram for Android on October 29, saying an attacker could use it as part of a three-bug chain to take control of a phone after its owner answered a call. Telegram’s Android version 12.10.4 contains a relevant code fix, according to NebuSec and a review of Telegram’s public source code described in the source report, but the complete attack chain has not been independently documented in a public technical write-up.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a span beginning in March 2022 and ending before the September 2026 release of version 12.10.4. The company described the bug as a memory-handling problem in code used for voice calls. It said the victim had to answer an incoming call, making the alleged method a one-click attack, not an attack requiring no user action.

According to NebuSec chief executive Eten Zou, speaking to The Hacker News, the call-related bug alone was not enough to compromise a device. Zou said it could be combined with a second flaw that leaked information and a third Android root exploit, which would provide administrator-level control. NebuSec said that control could extend to messages, the microphone and the camera. The company told the publication it tested the chain in private voice calls on ARM64 phones; the supplied reporting does not independently establish that the entire chain works across devices or current Android versions.

The report says Telegram acknowledged NebuSec’s disclosure but did not agree that the flaw could be used for remote code execution. No CVE number had been assigned as of October 29, and the source says there was no public Telegram response to a request for comment. NebuSec said it had seen no real attacks. That is the company’s account, not proof that the flaw was never used.

Why Call Handling Raises Risk

The issue matters because answering a call is an ordinary action, while call software must process information sent by the caller. If NebuSec’s account is accurate, a bug in that pathway could become an entry point for a broader compromise when combined with separate vulnerabilities. The reported chain therefore concerns more than a dropped call or a limited app error: it allegedly reaches device-level access.

For individual users, the practical step is straightforward: install Telegram 12.10.4 or later and limit incoming calls from people outside their contacts until updated. For organizations, the lack of a CVE may make the issue harder to spot in security workflows that rely on vulnerability identifiers. The source report recommends setting minimum app versions on work phones and establishing a clear policy for messaging apps. Those are precautionary measures; the supplied material does not establish that an organization has been attacked through this flaw.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix and Its Timeline

NebuSec announced the issue on X on October 29, alongside a short demonstration video. The company said it reported the bug to Telegram on September 26, shortly after version 12.10.4 had appeared. The source report says Telegram’s Android source code is publicly available and describes a comparison between versions 12.10.3 and 12.10.4: the older code checked that a camera-rotation field existed but then read a different video-state field, while the newer code reads the rotation field.

The source also reports that Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change labeled “Fix camera rotation.” The Android source with the fix appeared later, according to that account. The Hacker News reportedly said iOS received the change in May and desktop in July, but the source does not establish that those platforms were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the source report found no CVE entry for the flaw in the National Vulnerability Database and no Telegram entry in the cited CISA catalog of known exploited vulnerabilities. The absence of a listing does not determine whether a flaw is exploitable or whether anyone has used it. NebuSec’s full technical write-up was not available in the material provided.

“Now picking up a wrong call can get you hacked.”

— NebuSec’s October 29 post on X

What the Public Evidence Shows

The full chain remains unverified in public technical detail. The supplied report says NebuSec’s demonstration showed two phones and a successful-looking outcome, but did not identify the Telegram or Android versions running on the victim device. The report also says NebuSec had not published a technical write-up describing the two additional bugs, and its author could not independently check those flaws.

It is also unclear whether the alleged chain works on a fully updated Android phone, whether any users were targeted before the disclosure, and whether related code on iOS or desktop could be exploited. NebuSec’s statement that it had seen no attacks is not equivalent to evidence that no attacks occurred. Telegram’s position beyond the reported acknowledgement of the disclosure is not publicly detailed in the supplied material, and the reasons no CVE was assigned have not been confirmed by Telegram.

Update and Watch for Detail

Android users should check Telegram’s version in Settings and update to 12.10.4 or later. Until the app is updated, users can set “Who can call me?” to “My Contacts” or “Nobody” and decline unexpected calls. These steps reduce exposure to incoming calls; they do not establish that a particular account or device has been compromised.

The next useful developments would be a public technical account from NebuSec, a fuller statement from Telegram, and independent analysis of the reported chain across Android versions and devices. Until those details are available, the confirmed point is narrower: Telegram’s Android code was changed, NebuSec has described a possible multi-bug attack, and the scope and real-world use remain unsettled.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said the affected range was versions 8.6.2 through 12.10.3. It identified version 12.10.4 as containing the fix. The supplied reporting does not independently confirm every version’s exposure to the complete attack chain.

Did an attacker need to make the phone ring without an answer?

No. NebuSec said the victim had to answer an incoming call. On that description, the attack required one user action and was not zero-click.

Is there evidence that the flaw was used in real attacks?

NebuSec said it had seen no real attacks. The source report found no public exploitation listing, but the absence of such evidence does not prove that the flaw was never used.

Are Telegram on iOS or desktop affected?

The supplied material does not establish that iOS or desktop could be exploited. It reports that related code received a correction on those platforms, while NebuSec said it had no evidence they were directly affected.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later. If an update is not yet possible, restrict who can call the account to contacts or nobody and avoid answering unexpected calls.

Source: ThorstenMeyerAI.com