Could A Call Trigger Telegram’s Android Flaw?

🔍 Read the full analysis: Could A Call Trigger Telegram’s Android Flaw? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a Telegram for Android flaw on October 29, saying an attacker could exploit it after a user answered a voice call and combine it with two other bugs to gain control of the phone. Telegram’s Android version 12.10.4, released in September, includes a correction, according to NebuSec; the startup says it has seen no real-world attacks, and the full exploit chain has not been independently documented in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company described the issue as a memory bug in the app’s voice-call code. Its chief executive, Eten Zou, told The Hacker News that the call bug alone was not enough: when combined with an information-disclosure bug and an Android root exploit, it could let an attacker move beyond Telegram and gain broad control of the device.

In that account, an attacker needed an ordinary Telegram account and the victim had to answer the incoming call. That makes the described attack one-click, rather than zero-click. NebuSec said it confirmed the chain in private calls on ARM64 phones, a processor architecture used by most modern Android devices. It has not provided a public technical write-up explaining the other two bugs or how the complete chain works.

NebuSec announced the issue on X with a short demonstration video. The clip shows a call connecting on a phone labelled as the victim’s, followed by a screen displaying a message from the security company. The video does not identify the Telegram or Android versions used. The source article says a review of Telegram’s public Android code found a mismatch in how a call status message’s fields were checked and read in version 12.10.3, with the relevant field corrected in 12.10.4.

NebuSec said it reported the flaw to Telegram on September 26, after the fixed version had appeared. Zou said Telegram acknowledged the report but did not agree that the bug could be used for remote code execution. According to him, that meant there was no CVE assignment and no bounty payment. The source article reported finding no public Telegram statement. As of October 29, it also said the US National Vulnerability Database had no CVE entry for the flaw and the CISA known-exploited-vulnerabilities catalog contained no Telegram entry.

Why Answering a Call Matters

The risk described by NebuSec centers on an ordinary user action: answering a phone call. Call features must process data from another account as the call is being set up, before a user has much information about the caller. If the alleged chain is accurate, accepting a call could provide the opening for code execution and access beyond the messaging app. That possibility makes timely updates and call privacy settings relevant even though no attacks have been reported by NebuSec.

The disclosure also highlights a gap in vulnerability tracking. Without a CVE identifier, organizations whose security tools rely on CVE feeds may not automatically flag the issue. Employers managing work phones may need to check installed Telegram versions directly and set minimum app-version requirements. For individual users, the immediate steps are to update Telegram and, until updated, limit who can call them. The evidence available in the source does not establish that every call, caller, or Android device was vulnerable, nor does it confirm that the full exploit was used outside NebuSec’s testing.

Products Worth Considering

eufy Security eufyCam C37 4-Camera Kit with 360° Pan and Tilt

AmazonView Latest Price

eufy Security Essential Alarm System, 7-Piece, No Monthly Fee

AmazonView Latest Price

Dyson Cyclone V10 Origin Cordless Vacuum

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

The source article says Telegram publishes its Android app code on GitHub and that a comparison of versions 12.10.3 and 12.10.4 showed a change in the handling of call-related video-state information. In the earlier code, the app checked that a rotation value was present but then read a different field; the later version reads the rotation field. This code review supports the existence of a relevant change, but it does not by itself verify NebuSec’s claimed three-bug attack chain or establish that the flaw could take over a device.

The same account says Telegram’s shared call library received a related correction on April 21, 2026, in a change titled “Fix camera rotation,” months before the Android source update. It reports that iOS received the change in May and desktop in July, but says direct impact on those platforms or on group calls has not been demonstrated. NebuSec’s stated affected range is limited to Android versions 8.6.2 through 12.10.3.

There is also no public record cited in the source of a CVE or a listing in the US catalog of known exploited vulnerabilities as of the dates checked. Those absences do not prove that the flaw was never used. NebuSec said it had not seen attacks, while the source author said they could not independently check the additional bugs, the chain’s behavior on a fully patched Android device, or possible prior exploitation.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Exploit Evidence Shows

The public evidence described so far is incomplete. NebuSec has not published a technical write-up detailing the information-disclosure issue or the Android root exploit, and its demonstration video does not show the software versions on the phones. The source article says the call-code correction can be seen in Telegram’s public Android code, but that observation alone does not establish that the complete chain works as described.

It is also unclear whether the claimed chain works against a current, fully patched Android system, whether it affected other Telegram platforms, or whether anyone exploited the flaw before its disclosure. NebuSec reported no attacks it had seen; that statement is not proof that no attack ever occurred. The article found no public Telegram reply to the report, and the company’s position is relayed through Zou rather than a published technical explanation from Telegram.

Update the App and Restrict Calls

Telegram users should install the latest available Android release and check the version shown in the app’s Settings. The source identifies version 12.10.4 or later as including the correction. Until the app is updated, users can change “Who can call me?” to “My Contacts” or “Nobody,” and decline calls from unfamiliar accounts. These steps reduce exposure to incoming calls but do not replace installing the fix.

Organizations should check the Telegram versions on managed Android phones and decide whether to require a minimum version, rather than relying only on CVE-based alerts. Further clarity depends on whether Telegram or NebuSec publishes technical details, whether a CVE is assigned, and whether independent researchers can reproduce the claimed chain. No additional disclosure date or company response was specified in the source.

Key Questions

What is the Telegram Android flaw?

NebuSec describes a memory bug in Telegram’s voice-call code. The startup says it could be combined with two other bugs to gain control of an Android phone after the user answered a call. The full chain has not been laid out in a public technical report.

Which Telegram versions are reported as affected?

NebuSec says the affected range is Telegram for Android 8.6.2 through 12.10.3. It identifies version 12.10.4 as containing the fix. The source does not establish direct impact on iOS, desktop, or group calls.

Did the flaw affect users who did not answer a call?

According to NebuSec’s description, the victim had to answer an incoming call. The company characterized the attack as one-click, not zero-click. The public material cited does not independently verify the exploit chain.

Have attackers used the flaw?

NebuSec said it had seen no real attacks. The source reports no CVE entry or CISA known-exploited-vulnerabilities listing as of October 29, 2026. Those facts do not establish that the flaw was never exploited.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later and check the installed version in Settings. Until updated, set call permissions to My Contacts or Nobody and avoid answering calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com