Telegram’s Android Call Vulnerability: What’s Known So Far

🔍 Read the full analysis: Telegram’s Android Call Vulnerability: What’s Known So Far on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a vulnerability in Telegram for Android on October 29, saying the flaw was fixed in version 12.10.4 in September. The company claims that, when combined with two other bugs, it could let an attacker take control of an Android phone after a user answered a Telegram call; it says it has seen no real-world attacks, and the full exploit chain has not been independently established in the published material.

NebuSec said the vulnerable code affected Telegram for Android versions 8.6.2 through 12.10.3, a range it dates from March 2022 to September 2026. Its account describes a memory bug in the app’s voice-call code. The company says that bug alone was not enough to compromise a phone: it had to be combined with a separate information-leak bug and an Android root exploit, which would grant administrator-level access.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 phones. NebuSec’s October 29 post included a short demonstration video, but the video does not identify the Telegram or Android versions used on the target phone. The company had not published a detailed technical report on the flaw by that date, leaving the chain’s mechanics dependent on its statements and demonstration.

The flaw was reported to Telegram on September 26, according to Zou. He said Telegram acknowledged the report but did not consider the bug capable of enabling remote code execution, and that no vulnerability identifier or bounty followed. Telegram’s source code for Android is publicly available; the source material reports that a comparison of versions 12.10.3 and 12.10.4 found a change in how call status messages handle a video-rotation field. That code comparison supports the existence of a correction, but does not by itself verify the other two bugs or the full attack chain.

Why Answering a Call Matters

The reported scenario matters because it ties a routine action—answering an incoming call—to a possible compromise, rather than requiring the user to install a file or follow a link. If NebuSec’s account is accurate, an attacker would still need the victim to answer, making this a one-click attack, not a zero-click attack. The company says an ordinary Telegram account could initiate it.

For users, the confirmed practical step is to install Telegram 12.10.4 or later and check the app’s version in Settings. Until updated, the source recommends limiting who can call through Telegram’s privacy settings and declining calls from unknown people. For organizations, the absence of a CVE may matter: security systems that rely only on vulnerability identifiers might not flag the issue. Employers can set minimum app-version requirements for work phones, while recognizing that the exploit’s reach remains unconfirmed.

Call features must process data from another party to connect, which can make their code a security target. That general point does not establish that this particular flaw was exploited or that every Telegram call platform is affected. The case’s significance rests on the combination of a reported long-lived bug, a published software correction, and a still-incomplete public account of the alleged exploit.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation

AmazonView Latest Price

KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From Call-Code Fix to Disclosure

The reported Android fix arrived in version 12.10.4, which the source says was published September 24. NebuSec reported the issue to Telegram two days later. The timing means the correction preceded the public disclosure by about a month, although the source says Telegram’s shared call library had received a similar code correction earlier, on April 21, 2026, under a change titled “Fix camera rotation.”

The source says Telegram’s iOS and desktop apps also incorporated that shared change, in May and July respectively, citing The Hacker News. It does not establish that those apps were exploitable. NebuSec said it had no evidence that iOS, desktop, or group calls were directly affected. The reported issue concerns a specific Android call-code path, and findings about one platform should not be applied automatically to the others.

As of October 29, the source reported no CVE number and no listing for the flaw in the U.S. government’s Known Exploited Vulnerabilities catalog, whose cited version was dated October 28. Those absences do not prove the bug was never exploited; they show that it had not appeared in those records at the time covered by the report.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Does Not Show

The central uncertainty is whether the full three-bug chain works as described. NebuSec has offered a short demo and statements to a news outlet, but the source says it had not released a technical write-up. The demo does not show the app or Android versions, and the other two bugs could not be checked from the available material.

It is also unclear whether the chain works against a current, fully patched Android device, whether anyone used it before disclosure, or how many devices may have been exposed. NebuSec said it had seen no real attacks; that is not proof that none occurred. The source reports no public Telegram response, and the lack of a CVE or government exploitation listing does not settle the technical questions.

The available account also does not demonstrate direct exposure of iOS, desktop, or group calls. The shared-library history is relevant background, but it is not proof that those versions were vulnerable. Further technical detail or independent testing would be needed to resolve those points.

Update Now, Await Technical Detail

Android users should check Telegram’s version and update to 12.10.4 or later. Those who cannot update immediately can restrict incoming calls to contacts or nobody, and avoid answering calls from unknown accounts, as a precaution described in the source. These steps reduce exposure to the reported scenario but do not independently verify the vulnerability or establish that every unwanted call is dangerous.

Further clarity depends on whether Telegram or NebuSec publishes more technical information, and whether independent researchers can validate the bug and the alleged chain. Organizations may also review whether their mobile-device policies enforce current app versions rather than relying solely on CVE feeds. The status could change if additional evidence, a company statement, or reports of exploitation emerge.

Key Questions

Which Telegram Android versions did NebuSec say were affected?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the issue was fixed in version 12.10.4. The available account does not include an independently published technical report confirming the full scope.

Did the flaw let attackers hack a phone without any action?

No. NebuSec’s described scenario required the user to answer an incoming Telegram call. That makes the alleged attack one-click, rather than zero-click.

Have attacks using the vulnerability been confirmed?

No confirmed attacks are reported in the source material. NebuSec said it had seen no real attacks, but that statement does not establish that exploitation never occurred.

Are Telegram on iPhone or desktop affected?

The available material does not show that the iOS or desktop apps were exploitable. NebuSec said it had no evidence those apps, or group calls, were directly affected; the Android claim should not be treated as proof of risk on other platforms.

What should Telegram users do?

Update to Telegram for Android 12.10.4 or later and check the installed version in Settings. If an update is not available immediately, the source recommends restricting who can call and declining calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com