🔍 Read the full analysis: What To Do About Telegram’s Android Call Flaw on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Security startup NebuSec disclosed a Telegram for Android call-handling flaw on October 29, 2026, and says it was fixed in version 12.10.4, released in September. NebuSec alleges the bug could be combined with two other flaws to take control of a phone after a user answered a call; it says it has seen no attacks. Update Telegram and, until updated, restrict incoming calls to contacts or nobody.
Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could exploit it after a user answered a call if the bug were combined with two other vulnerabilities. Telegram had already released a version containing a code correction, 12.10.4, in September, according to the source material. NebuSec says it has seen no attacks; the full exploit chain has not been independently documented in a public technical report.
NebuSec said the affected Android app versions ran from 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company says the call-code flaw, combined with a separate information leak and an Android root exploit, could let an attacker move beyond Telegram and gain extensive control of a device. The alleged attack required the recipient to answer an incoming call, making it a one-click attack rather than a zero-click one. NebuSec told The Hacker News the attack worked in private voice calls on ARM64 devices, a processor architecture used in most modern Android phones.
The source material reports that Telegram’s public Android code includes a correction in version 12.10.4. A comparison of the published 12.10.3 and 12.10.4 code found that the earlier version checked for one call-message field but read a different field that might not be present; the later version reads the field it checked. That supports the existence of a code defect, but does not by itself verify the additional bugs or the full phone-takeover chain NebuSec described.
NebuSec said it reported the issue to Telegram on September 26, after the corrected Android version had appeared. The company’s chief executive, Eten Zou, told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of enabling remote code execution. The source material says no CVE identifier has been assigned and that it found no public Telegram statement. NebuSec’s disclosure included a short demonstration video, but the video did not identify the Telegram or Android versions on the test phone.
Infographic 01 · Telegram for Android
One tap on “answer”, three bugs, one fix.
What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.
- The callAn ordinary Telegram account calls the victim
- The tapThe victim answers. Without this, no attack
- Bug 1Call code misreads a status message (MediaState)
- Bug 2An information leak helps break out of the app
- Bug 3An Android root exploit: messages, mic, camera
Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.
- The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
- Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
- No CVE in the US vulnerability database (29 Oct)
- No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)
- Three chained bugs give full control of the phone
- Versions 8.6.2 to 12.10.3 are affected
- Its GPT-5.4-based product found the bug
- No real attacks seen; Telegram did not see code execution, paid no bounty
- What bugs 2 and 3 are
- Whether the chain works on fully patched Android
- Whether the old iOS and desktop code was exploitable
- Telegram’s own statement
- Mar 2022Version 8.6.2First version NebuSec names as affected
- 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
- 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
- 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
- 29 Oct 2026Public disclosurePost on X with a 22-second demo video
Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI
Steps Android Users Can Take
For Android users, the practical priority is to install Telegram 12.10.4 or a later release and verify the version shown in the app’s settings. If an update is not yet available or cannot be installed, NebuSec’s reported mitigation is to set “Who can call me?” to My Contacts or Nobody and avoid answering calls from unfamiliar accounts. These steps reduce exposure to the described route; they do not establish whether a device was targeted or eliminate other possible security risks.
The disclosure also matters to organisations that manage work phones. Because this issue has no CVE number, systems that rely only on CVE feeds may not flag it. Employers can check the Telegram version installed on managed devices, set a minimum allowed version, and apply their own policy for messaging and voice calls. That is a general response to the reported disclosure, not confirmation that the flaw was exploited in workplaces.
Popular right now
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Samsung 85-Inch QN70H Neo QLED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How the Call-Code Bug Was Found
Telegram’s Android source code is publicly available, and the source material describes a comparison between versions 12.10.3 and 12.10.4. During calls, the apps exchange status messages about features such as microphone muting, camera use and video rotation. In the earlier Android code, the program checked that the rotation value existed, then read a separate video-state field that was not required to be present. The correction changes which field is read.
The same source material says Telegram’s shared call library received a similar correction on April 21, 2026, in a change titled “Fix camera rotation”; the Android source containing the fix appeared later. It also reports that the iOS app incorporated the change in May and the desktop app in July. That timing is not proof that those apps were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected, and the material does not establish that they were.
As of October 29, the source material reported no matching entry in the U.S. National Vulnerability Database and no Telegram listing in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, using the catalog version dated October 28. Those absences do not prove that the flaw was never exploited. NebuSec said it had not seen real attacks, while the complete technical details remained unpublished.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in a post announcing the disclosure on X
What the Disclosure Does Not Establish
The complete exploit chain remains NebuSec’s account. The source material says the company had not published a detailed technical write-up by October 29, and the demonstration did not show the software versions used. It is therefore not possible from the available material to verify the two additional bugs, reproduce the claimed takeover, or determine whether the chain works on a fully patched Android device.
There is also no confirmed record in the material of attackers using the flaw. NebuSec said it had seen no real attacks, but that statement is not evidence that no exploitation occurred. The source material reports no assigned CVE and no public response from Telegram; it also says Telegram acknowledged NebuSec’s report privately, according to Zou. Whether the lack of a CVE reflects a disagreement over severity, disclosure process or another reason is not fully established.
The effect on iOS, desktop clients and group calls is unresolved. A correction in shared call code or in later app versions does not, on its own, show that those platforms were vulnerable to the same attack. NebuSec said it had no evidence of direct impact there, and no independent platform-by-platform assessment is included in the source material.
Update Before Answering Calls
Android users should check Telegram’s version in Settings and install 12.10.4 or a later version if available. Until updated, they can limit incoming calls to contacts or turn them off, and decline calls from unknown people. Organisations using Telegram on managed phones can check installed versions and consider requiring the corrected release.
The next useful developments would be a public technical account from NebuSec, further comment from Telegram, and independent analysis of the alleged exploit chain and affected platforms. Until those details are available, the code correction and version guidance are actionable, while claims of full device takeover should remain attributed to NebuSec.
Key Questions
Which Telegram Android versions does NebuSec say were affected?
NebuSec identifies versions 8.6.2 through 12.10.3 as affected. It says the correction is in version 12.10.4. Check Settings for the version installed and update if a later release is available.
Could someone exploit the flaw without me answering a call?
According to NebuSec’s description, the recipient had to answer the incoming call. The reported attack is therefore one-click, not zero-click. The full chain has not been independently documented in the source material.
What should I do if I cannot update Telegram yet?
Set Telegram’s “Who can call me?” option to My Contacts or Nobody and avoid answering calls from unfamiliar accounts until you can update. These are precautionary steps based on NebuSec’s account of the flaw.
Is there evidence that attackers used this flaw?
NebuSec says it has seen no real attacks. The source material reports no CVE assignment or known-exploited-vulnerability listing as of October 29, 2026. That does not establish that exploitation never happened.
Are Telegram on iPhone and desktop affected?
The available material does not establish that. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected. The scope across platforms remains unresolved.
Source: ThorstenMeyerAI.com
