Telegram’s Android Vulnerability: Understanding The Call Risk

🔍 Read the full analysis: Telegram’s Android Vulnerability: Understanding The Call Risk on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying it could be combined with two other bugs to give an attacker control of a phone after the user answered a call. Telegram’s Android version 12.10.4, released in late September, contains a correction to the call-code issue, according to NebuSec and a review of Telegram’s public source code; the startup says it has seen no real-world attacks.

NebuSec said the call flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company described the attack as requiring the target to answer an incoming Telegram call, making it a one-click attack rather than a zero-click one. It said an ordinary Telegram account was enough to make the call.

According to NebuSec chief executive Eten Zou, the call-code bug alone did not grant full access. The company says it combined the flaw with a second bug that leaked information and a third vulnerability that enabled Android root privileges. Root access would give an attacker extensive control over the device. NebuSec said it tested the chain in private voice calls on ARM64 phones, a processor architecture used by most current Android phones.

The disclosure included a 22-second demonstration video showing a call connecting on a device labelled as the victim’s, followed by the phone returning to its home screen and displaying a NebuSec message. The footage does not identify the Telegram or Android versions used. As of October 29, the company had not published a technical report explaining the full chain. The available account of the companion bugs and device takeover therefore rests on NebuSec’s statements and demonstration, rather than a public technical analysis.

Why Answering a Call Matters

The report draws attention to a risk in a familiar action: answering a call. Messaging apps have to process connection and call-status data from people who may not be in a user’s contacts. If that processing contains a software error, an incoming call can create an opening before the recipient has exchanged any other messages with the caller. In this case, however, the alleged compromise requires the user to answer the call; the source material does not describe a successful attack that works without that action.

For users, the immediate practical point is that the Android fix is available. Updating to version 12.10.4 or later addresses the code change identified in the report. Until updated, users can restrict who is allowed to call them and avoid answering calls from unknown accounts. These steps reduce exposure to the reported route, but they are not evidence that an attack has taken place or that every other risk is eliminated.

The absence of a CVE identifier also matters to organizations that use vulnerability-tracking systems. The source reports no CVE for the issue and no listing in the US catalog of known exploited vulnerabilities as of October 29. Companies whose security tools rely on CVE feeds may not flag this particular issue automatically. IT teams may need to set minimum app versions on managed phones and communicate a messaging-app update policy.

Products Worth Considering

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Android Fix Was Found

NebuSec said it reported the vulnerability to Telegram on September 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the issue capable of being turned into remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material reports no public response from Telegram to The Hacker News’ request for comment.

A review of Telegram’s publicly available Android source code compared versions 12.10.3 and 12.10.4. The change concerned a call-status message containing fields such as microphone mute status, camera status and video rotation. In the older code, the app checked that a rotation value was present but then read a different field, the video state. In the newer code, it reads the rotation field it had checked. That code comparison supports the existence of a correction in the Android app, but it does not by itself verify NebuSec’s account of the two additional bugs or the full attack chain.

The same source review found that Telegram’s shared call library, used across its Android, iOS and desktop apps, had received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source with the correction appeared later. The source material says the iOS and desktop apps also incorporated the change, but it does not establish whether the older code could be exploited on those platforms. NebuSec reported no evidence that group calls or the iOS and desktop apps were directly affected.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Questions About the Attack Chain

Several parts of the disclosure remain unverified publicly. NebuSec has not released a technical write-up detailing the two additional bugs, how they were chained to the call-code issue, or the conditions needed for full device control. The demonstration does not show the software versions on the victim device, and the available material does not independently establish whether the described chain works on a fully updated Android phone.

The source says NebuSec has seen no real-world attacks, but that does not establish that no one used the flaw. There is no CVE number, no listing for the issue in the cited US exploited-vulnerability catalog, and no public Telegram statement in the material provided. The extent of the vulnerability across Android versions and the potential relevance of related code in other Telegram apps also remain unclear.

Updating and Further Verification

Android users can check Telegram’s version in the app’s settings and update to 12.10.4 or later. For users who cannot update immediately, NebuSec’s reported precautions are to limit incoming calls to contacts or nobody and to decline calls from unfamiliar accounts. Organizations should check whether managed phones meet their minimum app-version requirements rather than relying only on CVE-based alerts.

Further clarity depends on a fuller technical account from NebuSec and any public response or advisory from Telegram. Such information could help establish how the companion vulnerabilities worked, which devices and app versions were susceptible, and whether the issue affected platforms beyond the Android version identified. Until then, the Android code fix is supported by the source comparison, while claims about a complete phone takeover remain attributed to NebuSec.

Key Questions

What is the Telegram Android vulnerability?

It is a reported flaw in Telegram’s Android voice-call code. NebuSec says it could be combined with two other bugs to take control of a phone after a user answered an incoming call.

Which Telegram version includes the fix?

The source material identifies Telegram for Android 12.10.4 as the version containing the code correction. Users should update to that version or a later one.

Could an attacker take over a phone without the user answering?

NebuSec described the attack as requiring the recipient to answer an incoming call. The available report does not establish a zero-click attack that works without user action.

Are there confirmed attacks or evidence that the iOS app is affected?

NebuSec said it had seen no real-world attacks. The source material does not show that iOS was exploitable; it says the shared call code was corrected in other apps but that direct impact there has not been demonstrated.

Why does the lack of a CVE matter?

Some security tools use CVE identifiers to track and flag vulnerabilities. Without one, organizations may need to check app versions and set update requirements directly. The lack of a CVE does not by itself prove that a flaw is harmless or exploited.

Source: ThorstenMeyerAI.com