Telegram Android Flaw: A Practical Guide To Staying Informed

🔍 Read the full analysis: Telegram Android Flaw: A Practical Guide To Staying Informed on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could exploit it after a user answered a call if the flaw were combined with two other bugs. Telegram’s Android version 12.10.4, released in September, contains a correction to the call code, according to NebuSec. The company said it had seen no real-world attacks; the full attack chain has not been documented publicly, and no CVE has been assigned.

NebuSec said the flaw affects Telegram for Android versions 8.6.2 through 12.10.3, a range it dates from March 2022 to September 2026. It described a memory-handling bug in the app’s voice-call code. According to the company’s chief executive, Eten Zou, that bug alone was not enough to take control of a phone: an attacker would also need to use a separate information-leak bug and an Android root exploit. Root access provides administrator-level control of a device.

Zou told The Hacker News that NebuSec tested the chain in private voice calls on ARM64 Android phones. The company’s October 29 post on X included a short demonstration video. The clip shows a call connecting and the victim phone returning to its home screen, but it does not identify the Telegram or Android version used. NebuSec had not published a technical write-up of the flaw as of October 29, leaving the detailed mechanics dependent on its account and demonstration.

NebuSec reported the flaw to Telegram on September 26, Zou said. Telegram acknowledged the report but, according to him, did not agree that the bug could be used for remote code execution. Zou said no CVE was assigned and no bounty was paid. Telegram had not issued a public response in the source material. A review of Telegram’s public Android code found that version 12.10.4 reads the video-rotation field that an earlier version handled incorrectly.

Why Answering a Call Matters

The reported scenario puts a familiar user action at the center of the risk: answering an incoming call. Call software must process setup data from the caller before a recipient can decide whether to engage, making its handling of unexpected or malformed data security-relevant. Google’s Project Zero wrote in 2018 that picking up a call is “a reasonable action to expect a user to take.”

If NebuSec’s account is accurate, the issue could matter to people using older Android app versions because the call bug was one step in a chain that allegedly ended in full device access. That could expose messages and allow access to the microphone or camera, Zou said. Those impacts are claims about the combined exploit, not independently demonstrated facts in the public material. NebuSec says it has seen no actual attacks, and the available demo does not establish which software versions were targeted.

The lack of a CVE also means organizations relying only on vulnerability databases may not see this issue through their usual tracking systems. That does not establish that the flaw was exploited or that every older installation was vulnerable in practice. It does make app-version controls and a clear policy for work messaging relevant for administrators.

Products Worth Considering

Trezor Safe 7 Crypto Hardware Wallet

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

Telegram’s Android 12.10.4 release appeared on September 24, according to the source material, two days before NebuSec reported the issue. The prior version, 12.10.3, was published on September 17. Comparing the public code for those versions, the source author found that the earlier call code checked whether a rotation value existed but then read a different field that did not necessarily have to be present. The newer code reads the rotation field instead.

The correction also appeared earlier in Telegram’s shared call library, tgcalls, which is used across its Android, iOS and desktop apps. A change titled “Fix camera rotation” was made on April 21, 2026; the Android source containing the correction appeared 156 days later, according to the source author’s calculation. The Hacker News reported that iOS incorporated the change in May and desktop in July. That shared-code history does not establish that the reported exploit works on iOS or desktop, and NebuSec has not shown those platforms are directly affected.

As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, dated October 28, had no Telegram entry. Those absences describe the listings at that time; they do not prove that no attacks occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The most important unresolved issue is whether the complete exploit chain works as NebuSec describes. The source material says the company has not published a technical report, and the demonstration does not reveal the victim phone’s Telegram or Android version. The separate information-leak bug and root exploit have not been independently examined in the material provided.

It is also unclear whether anyone exploited the flaw before its disclosure. NebuSec said it had seen no real attacks, a statement that does not rule out activity it did not detect. The source author could not verify the other two bugs or test whether the chain works on a fully patched Android device. There is no CVE entry as of October 29, and Telegram had not publicly responded by then.

NebuSec reported testing private calls on ARM64 devices. It said it had no evidence that group calls or Telegram’s iOS and desktop apps were directly affected. The presence of similar shared call code, and reported fixes on those platforms, does not by itself confirm either vulnerability or safety.

Update Android and Check Settings

Android users should check the Telegram version shown in the app’s Settings and install version 12.10.4 or later, the version NebuSec identified as containing the fix. Until updated, the source advises limiting incoming calls under “Who can call me?” to My Contacts or Nobody, and declining calls from unfamiliar people. These steps reduce exposure to calls from strangers but do not verify whether a device has been targeted.

Organizations should check minimum Telegram versions on managed phones and decide which messaging apps are permitted for work. A policy based only on CVE feeds could miss an issue without a CVE, so administrators may need to track app updates directly. Readers should treat NebuSec’s account as a reported security finding, not as proof that all older devices were attacked.

The next useful developments would be a technical write-up from NebuSec, a public statement from Telegram, or further independent analysis of the reported chain. Until then, the fix is available, but the exploit details and extent of any exposure remain incompletely verified.

Key Questions

Which Telegram Android versions did NebuSec identify as affected?

NebuSec said versions 8.6.2 through 12.10.3 were affected. It identified version 12.10.4 as containing the fix.

Did NebuSec say the flaw was used in real attacks?

No. NebuSec said it had seen no real-world attacks. That is the company’s observation, not proof that the flaw was never used.

Could answering a call alone take over a phone?

NebuSec said the call-code flaw had to be combined with two other bugs to achieve full device control. The public material does not independently verify the full chain.

Are Telegram on iPhone and desktop confirmed affected?

No. NebuSec said it had no evidence that iOS or desktop apps were directly affected. Similar shared call code and reported fixes do not establish that the exploit works on those platforms.

What should Android users do now?

Update Telegram to 12.10.4 or later. Before updating, users can restrict who may call them to contacts or nobody and decline calls from unfamiliar people.

Source: ThorstenMeyerAI.com