Telegram’s Android Flaw: What We Know And What To Do Now

🔍 Read the full analysis: Telegram’s Android Flaw: What We Know And What To Do Now on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get movie nights delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a memory flaw in Telegram’s Android call code on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after its owner answered a call. Telegram’s Android app version 12.10.4, released in September, contains the reported fix, but the full attack chain has not been independently documented in a public technical report.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company says the bug alone was not enough to seize a device: an attacker also needed two other vulnerabilities, including one to escape the Telegram app and an Android root exploit that could grant administrator-level access. NebuSec described the scenario as one-click, because the victim had to answer the call; it was not a zero-click attack.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the attack in private voice calls on ARM64 phones. The startup posted a short demonstration video on October 29. The video shows a call connecting and the victim phone returning to its home screen, but it does not identify the Telegram or Android versions used. As of October 29, NebuSec had not published a technical write-up detailing the complete chain.

The source code for Telegram’s Android app is public. The source article reports that a comparison of versions 12.10.3 and 12.10.4 found a change in how call messages are handled: the older code checked whether a video-rotation value was present, then read a different field that might be absent. The updated code reads the rotation field. This code comparison supports the existence of a relevant fix, but does not by itself verify NebuSec’s claims about the additional bugs or the impact of the full attack.

Why Answering a Call Matters

Calls can expose users to incoming data from people they do not know, making call-handling code a potential attack surface. In the scenario NebuSec describes, a person did not need to open a file or follow a link; answering an unfamiliar Telegram call would trigger the initial step. That makes the report relevant to anyone using an unpatched Android app, even though the claimed device takeover depends on vulnerabilities beyond the call-code flaw.

The practical response is straightforward: update Telegram and check the installed version. Until updated, users can reduce exposure by setting “Who can call me?” to “My Contacts” or “Nobody” and declining unexpected calls. Organizations should also consider enforcing minimum app versions on work phones. Because the report has no CVE number, security tools that rely only on CVE records may not flag it.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black

AmazonView Latest Price

De'Longhi Magnifica Evo Automatic Espresso Machine with Milk Frother – Silver

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec says it reported the flaw to Telegram on September 26, shortly after version 12.10.4 became available. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source article says it found no public response from Telegram.

The source article’s review of Telegram’s public code found that the shared call library received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” It also says the Android source containing the fix appeared later, in version 12.10.4. The Hacker News reported that iOS received the change in May and desktop in July. These details do not establish that those apps were exploitable: NebuSec has not shown that they were directly affected, or that group calls were vulnerable.

As of October 29, the flaw had no entry in the US National Vulnerability Database under a CVE, according to the source article, and the October 28 CISA catalog of known exploited vulnerabilities contained no Telegram entry. Those absences do not prove that nobody exploited the flaw; they describe the state of those public records at that time.

““Now picking up a wrong call can get you hacked.””

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The reported memory bug and the code change can be checked against Telegram’s public Android source, but the broader claim of full device takeover remains attributed to NebuSec. The company’s video does not show the victim’s app or operating-system versions, and its public materials did not include a technical account of the second and third vulnerabilities. The source article says those parts of the chain could not be independently checked.

NebuSec said it had seen no real-world attacks. That is not proof that the flaw was never used. It also remains unclear whether a fully updated Android device could still be affected through another part of the chain, whether related app versions outside Android were exploitable, and whether Telegram will issue a public security advisory or CVE.

Update and Watch for Advisories

Android users should install the latest Telegram release available to them and check the version number at the bottom of the app’s Settings screen. The source article identifies 12.10.4 or later as the patched range. If an update is not yet available through a device’s app store, users can limit incoming calls to contacts or disable them temporarily and avoid answering unexpected calls.

Businesses should check managed devices for outdated Telegram installations and set a minimum supported app version. Further clarity depends on a detailed technical report, a public response from Telegram, or independent analysis of the claimed exploit chain. Until then, the confirmed fix is a reason to update, while the extent and any prior use of the alleged attack remain unresolved.

Key Questions

Which Telegram Android versions are reported as affected?

NebuSec says the affected range is versions 8.6.2 through 12.10.3. The company identifies version 12.10.4 as containing the fix.

Could answering a call alone take over a phone?

Not according to NebuSec’s description of the chain: the company says the call-code flaw had to be combined with two additional bugs, including an Android root exploit. The full chain has not been documented in a public technical report.

What should Telegram users do now?

Update Telegram for Android and check that the app is version 12.10.4 or later. Until updated, restrict calls to contacts or set “Who can call me?” to “Nobody,” and decline unexpected calls.

Does the report affect Telegram on iPhone or desktop?

NebuSec has not established that iOS or desktop apps were directly affected, and it has not shown that group calls were vulnerable. Related code reportedly received a correction in other versions, but that alone does not confirm exploitability.

Has the flaw been used in real attacks?

NebuSec says it has seen no real-world attacks. That statement does not establish that exploitation never occurred, and the flaw had no CVE listing or CISA known-exploited-vulnerability entry as of the dates reported.

Source: ThorstenMeyerAI.com