Telegram’s Android Call Flaw: A Checklist For Informed Users

🔍 Read the full analysis: Telegram’s Android Call Flaw: A Checklist For Informed Users on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying that an attacker could use it as part of a chain of bugs to take control of a phone after a user answered a call. Telegram Android 12.10.4, released in September, contains a correction, according to NebuSec; users on older versions should update and limit who can call them while they do so. The complete attack chain has not been publicly documented, and NebuSec says it has seen no real-world attacks.

NebuSec said the flaw affects Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company described a memory-handling bug in call code. According to NebuSec chief executive Eten Zou, the flaw alone was not enough to take over a device: it was combined with a second bug that exposed information and a third Android exploit that provided root, or administrator-level, access.

NebuSec said its chain worked in private voice calls on ARM64 phones and required the victim to answer. That makes the described attack one-click, rather than zero-click. The company said an attacker needed an ordinary Telegram account. Its 22-second demonstration video shows a call connecting and the victim phone returning to its home screen, but does not identify the Telegram or Android versions on the device. The video does not independently establish the technical details of the exploit.

The source report says a comparison of Telegram’s publicly available Android code found that version 12.10.3 checked whether a camera-rotation field was present but then read a separate video-state field, which might be absent. Version 12.10.4 reads the rotation field instead. Telegram’s shared calling library received a similar correction in April 2026, according to the report’s review of public code. That finding supports the presence of a code change, but does not by itself verify NebuSec’s account of a working phone-takeover chain.

Why Answered Calls Matter

The claim matters because answering a call is an ordinary user action, and call software processes data from the person calling. If NebuSec’s full chain is accurate, a call could serve as the entry point for a much more serious compromise than an app crash or a call disruption. The company says access could extend to messages, the microphone and the camera, but those outcomes depend on the additional bugs it describes, not on the call flaw alone.

For individual users, the practical steps are direct: install Telegram Android 12.10.4 or later, check the app version in Settings, and set “Who can call me?” to “My Contacts” or “Nobody” until updated. Declining calls from unknown accounts can reduce exposure, though it is not a substitute for installing the fix. Employers should check that work phones meet a minimum app version and account for messenger software in mobile-device policies.

The absence of a CVE identifier also has implications for security teams. Organizations that rely only on CVE feeds to find vulnerable software may not see this report through those channels. That does not prove the flaw was exploited or establish its severity independently; it means teams may need to monitor vendor updates and credible security disclosures as well as vulnerability databases.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec announced the issue on October 29, 2026, through a post on X and a short demonstration. Zou told The Hacker News that the company had reported the flaw to Telegram on September 26, after version 12.10.4 had appeared. Zou said Telegram acknowledged the report but did not agree that the bug could be turned into remote code execution. According to the source report, no bounty was paid and no CVE was assigned.

The source report found that Telegram’s shared calling library, used by Android, iOS and desktop apps, received a correction on April 21, 2026, in a change titled “Fix camera rotation.” It says the Android source containing the correction was published later, in September. The Hacker News reported that iOS and desktop versions also picked up the library change. The existence of a similar code correction in those apps does not establish that they were exploitable; NebuSec has not shown direct impact on iOS, desktop or group calls.

As of October 29, the source report found no CVE listing for the issue in the U.S. National Vulnerability Database and no Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog. Those absences are status checks, not proof that no attack occurred. NebuSec said it had seen no real attacks, and the source report found no public technical write-up from the company.

“Now picking up a wrong call can get you hacked.”

— NebuSec’s October 29 post on X

What the Public Evidence Shows

The key unresolved issue is whether NebuSec’s complete chain can be independently reproduced. As of October 29, the company had not published a detailed technical write-up, and its demonstration did not show the software versions involved. The code comparison described in the source report supports a change in how Telegram handles call data, but it does not verify the second information-disclosure bug, the Android root exploit or the claimed full device access.

It is also unclear whether the chain works on a current, fully patched Android phone, whether any attacker used the flaw before disclosure, and whether related code changes created exposure in iOS or desktop apps. NebuSec reported no attacks observed; that is not the same as proof that no attacks occurred. The source report said it found no public response from Telegram by October 29.

Update and Watch for Details

Android users should install Telegram 12.10.4 or later and confirm the version shown in the app’s Settings. Those unable to update immediately can restrict calls to contacts or disable them, then avoid answering calls from unfamiliar accounts. Organizations should verify app versions on managed phones and set a minimum-version requirement rather than relying solely on CVE-based alerts.

The next useful developments would be a detailed technical account from NebuSec, further comment from Telegram, or independent analysis confirming the exploit chain and its affected devices. Until then, the fix is the clearest actionable fact, while the reported consequences and scope should be treated as claims that still need public verification.

Key Questions

Which Telegram Android versions did NebuSec say were affected?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the flaw was fixed in version 12.10.4. Users should install version 12.10.4 or later.

Did the attack work without the user answering a call?

No. NebuSec described an attack that required the recipient to answer the call, making it one-click rather than zero-click.

Has Telegram confirmed the reported phone takeover?

The source report found no public Telegram statement by October 29, 2026. NebuSec said Telegram acknowledged its report but disputed that the flaw could be turned into remote code execution. The full exploit chain has not been documented publicly.

Were real attacks reported?

NebuSec said it had seen no real attacks. That describes what the company observed and does not establish that the flaw was never used.

Could iOS or desktop Telegram users be affected?

NebuSec had not shown direct impact on iOS or desktop apps, or on group calls. The shared calling library received a related correction, but that alone does not prove those versions were exploitable.

Source: ThorstenMeyerAI.com