Telegram’s Android Call Flaw: Steps For Staying Up To Date

🔍 Read the full analysis: Telegram’s Android Call Flaw: Steps For Staying Up To Date on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying it could help attackers take control of a phone if a user answered a call and the flaw was combined with two other bugs. Telegram’s Android version 12.10.4, released in September, contains a correction, according to NebuSec; the company says it has seen no real-world attacks.

NebuSec chief executive Eten Zou told The Hacker News that the call-code bug was one part of a three-bug chain. According to Zou, a second bug could expose information and help an attacker escape the Telegram app into Android, while a third exploit could obtain root access — administrator-level control of the device. The attacker would need a Telegram account, and the victim would have to answer the incoming call. That makes the scenario one-click, not zero-click, based on the account given to The Hacker News.

NebuSec said it confirmed the chain during private voice calls on ARM64 Android phones, a processor architecture used by most modern Android devices. Its short demonstration video shows a call connecting on a phone labelled as the victim’s, followed by a screen indicating a compromise. The video does not identify the Telegram or Android versions used, and it does not independently establish each stage of the attack chain. As of October 29, NebuSec had not published a detailed technical write-up of the flaw.

The company said the affected Telegram Android versions were 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. It identified version 12.10.4 as fixed. A review of Telegram’s public Android source code described in the source report found that the corrected version reads a video-rotation field that the earlier code did not properly check. The reported flaw has no CVE identifier, and the National Vulnerability Database had no listing for it as of October 29.

How an Answered Call Could Matter

The concern is that an incoming call is an ordinary interaction that prompts an app to process data from another account. If NebuSec’s account is accurate, answering a call could provide the opening for a chain that moves beyond Telegram and compromises the phone. That could expose more than call settings: Zou said the final stage could give access to messages, the microphone and the camera. Those outcomes are claims from the company, not independently verified findings in the material available.

For users, the immediate action is straightforward: install Telegram 12.10.4 or a later version and check the version shown in the app’s Settings. People who cannot update immediately can reduce exposure by setting “Who can call me?” to “My Contacts” or “Nobody,” and by declining calls from unfamiliar accounts. Organizations face a separate visibility issue: without a CVE, security tools that rely only on CVE feeds may not flag the app version. IT teams may need to set minimum app versions and define rules for messaging apps on work phones.

Products Worth Considering

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

HP Sprocket Photo Booth Instant Color Printer Bundle

AmazonView Latest Price

Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec said it reported the issue to Telegram on September 26, after version 12.10.4 had already appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the flaw capable of enabling remote code execution. He said no CVE was assigned and no bounty was paid. The report’s author said they found no public response from Telegram; the source material does not include a direct statement from the company.

The source report also compared Telegram’s public Android code for versions 12.10.3 and 12.10.4 and found a change in how a call message’s video-rotation value is read. It said Telegram’s shared calling library received the same correction in April 2026, months before the Android source update. The report said iOS incorporated the change in May and desktop in July, citing The Hacker News. NebuSec did not establish that those versions or group calls are vulnerable, and the available information does not show that the issue affected them.

As of October 29, the flaw did not appear in the US Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, according to the source report. NebuSec said it had no evidence of attacks in the wild. That is a statement about what the company had observed, not proof that exploitation never occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the flaw

What the Public Evidence Does Not Show

The extent of the risk remains difficult to assess because no detailed public technical write-up was available from NebuSec as of October 29, and the cited demonstration does not show the software versions or technical steps involved. The source report says its reviewer could inspect Telegram’s Android code but could not verify the two additional bugs, test whether the full chain works on a fully updated Android phone, or establish whether anyone used the flaw before disclosure.

It is also unclear whether the issue was exploitable in Telegram for iOS or desktop, or during group calls. The source material says NebuSec had no evidence those versions or call types were directly affected; that does not establish that they were vulnerable or that they were safe. Telegram’s public position on the report was not available in the supplied material. NebuSec’s statement that it had seen no attacks should be treated as limited to its own observations.

Update and Watch for More Detail

Android users should open Telegram’s Settings and check the version listed at the bottom. If it is earlier than 12.10.4, update through the app’s available update channel. Until updated, restrict incoming calls to contacts or disable them, and avoid answering calls from unfamiliar accounts. These precautions address the reported call scenario; they do not confirm that every unrecognized call is malicious.

The next useful developments would be a fuller technical account from NebuSec, a public response from Telegram, and clarification about affected Android configurations and the other two bugs in the alleged chain. Organizations should review app-version enforcement rather than relying exclusively on CVE monitoring. At the time of disclosure, there was no CVE entry and no confirmed public account of real-world exploitation.

Key Questions

What did NebuSec report?

NebuSec reported a flaw in Telegram’s Android voice-call code. The company said it could be combined with two other bugs to take control of a phone after the user answered a call. The full chain has not been independently confirmed in a public technical write-up.

Which Telegram version contains the fix?

NebuSec identified Telegram for Android 12.10.4 as the fixed version. Users should update to that version or later and check the version number in the app’s Settings.

Does the report say attacks are happening?

No. NebuSec said it had seen no real-world attacks. That describes the company’s observations; it does not prove that exploitation never occurred.

Does the flaw affect Telegram on iPhone or desktop?

The supplied material does not establish that iOS or desktop versions are vulnerable. NebuSec had no evidence those apps were directly affected, and the report said the scope remained unclear. The Android finding should not be treated as confirmation of risk on other platforms.

What should I do if I cannot update right away?

Set Telegram’s “Who can call me?” control to My Contacts or Nobody, and decline calls from unfamiliar accounts until the app is updated. These are interim precautions, not a substitute for installing the fixed version.

Source: ThorstenMeyerAI.com