Telegram Android Flaw: What The Call Attack Report Says

🔍 Read the full analysis: Telegram Android Flaw: What The Call Attack Report Says on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after the user answered a call. Telegram had already corrected the relevant call-code issue in Android version 12.10.4, released in September, but the complete attack chain has not been publicly documented or independently verified.

NebuSec chief executive Eten Zou told The Hacker News that the call bug alone was not enough to compromise a phone. He said it could be combined with a second bug that leaks information and a third vulnerability that provides Android root access, or administrator-level control. According to Zou, the attacker needed an ordinary Telegram account, and the attack worked in private voice calls on ARM64 phones, a processor architecture used by most modern Android devices.

NebuSec posted a short demonstration video alongside its October 29 disclosure. It shows a call connecting on a victim phone before the screen returns to the home screen and displays a message claiming the device was hacked. The video does not identify the Telegram or Android versions shown. NebuSec says it has seen no real-world attacks, and the flaw has no CVE identifier. The reported chain therefore remains largely supported by the startup’s account and video rather than a public technical analysis.

A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 shows a change in how the app reads a call-status message. In the earlier code, the app checked that a video-rotation value existed but then read a different field that might not be present. The later version reads the rotation field instead. This confirms a relevant code change, but does not by itself establish that the bug could be used to execute the full attack described by NebuSec.

Why Answering a Call Matters

The report matters because it describes a possible route from an ordinary incoming call to control beyond the Telegram app. If the full chain worked as NebuSec says, the consequences could extend to private messages and access to the phone’s microphone and camera. Those outcomes are claims about the combined vulnerabilities, not independently demonstrated facts in the available public material.

Calls are also a practical security boundary: an app has to process incoming connection data before a user can decide whether to trust the caller. Google’s Project Zero wrote in 2018 that answering a call is “a reasonable action to expect a user to take.” That observation helps explain why calling features can be attractive targets, but it does not verify the Telegram report.

The absence of a CVE can also make a patched flaw harder for organizations to track. Companies whose security tools rely on CVE lists may not see this issue in those systems. A minimum-version requirement for work phones and a policy limiting who can call staff can reduce exposure while administrators verify their app inventory.

Popular right now

Vitamix Propel Series 750 Professional-Grade Blender, 4 Programs, Black

AmazonView Latest Price

KitchenAid Artisan Series 5-Quart Tilt-Head Stand Mixer, Dried Rose (KSM150PS)

AmazonView Latest Price

Dyson V8 Cyclone Cordless Vacuum

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Patch Predates the Disclosure

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the issue capable of remote code execution; he said no CVE was assigned and no bounty was paid. The source material reports no public response from Telegram to The Hacker News’ request for comment.

The change also appears in Telegram’s shared calling library, tgcalls, which is used by its Android, iOS and desktop apps. The library received a correction on April 21, 2026, under the change title “Fix camera rotation.” The Android source containing the fix appeared later, in September. The Hacker News reported that iOS incorporated the change in May and desktop in July, but the available material does not establish whether those earlier versions were exploitable.

According to the report, NebuSec identifies Telegram Android versions 8.6.2 through 12.10.3 as affected, covering releases from March 2022 to September 2026. Version 12.10.4 is the stated fix. The company said it had no evidence that Telegram’s iOS or desktop apps, or group calls, were directly affected.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Limits of the Public Evidence

The full exploit chain remains unverified publicly. NebuSec has not published a technical write-up of the flaw or the two additional bugs in the material available as of October 29. The demonstration video does not show the software versions on the victim device, and the code comparison confirms a correction but not the claimed route to root access.

It is also unclear whether the attack would work on a fully updated Android device, whether anyone exploited the issue before disclosure, or whether any iOS or desktop release was vulnerable. NebuSec says it has seen no attacks; that means the company has no evidence of them, not that exploitation can be ruled out. The U.S. National Vulnerability Database had no CVE entry for the flaw as of October 29, and the CISA known-exploited-vulnerabilities catalog dated October 28 had no Telegram entry. Neither absence establishes that the flaw was harmless or never used.

Update and Restrict Incoming Calls

Android users should install the latest Telegram release and check the version number at the bottom of the app’s Settings screen; 12.10.4 or later is the version specified as fixed in the report. Until updated, users can set “Who can call me?” to “My Contacts” or “Nobody,” and decline calls from people they do not recognize.

Security teams can check managed phones for Telegram versions below 12.10.4 and set a minimum permitted app version. They may also need to track the issue through vendor advisories or app-version controls because it has no CVE identifier. Further clarity depends on whether NebuSec publishes technical details, Telegram provides a public account of the fix, or independent researchers reproduce the reported chain.

Key Questions

What is the Telegram Android flaw?

NebuSec reported a bug in Telegram’s Android calling code involving how the app reads a call-status message. The startup says this bug could be combined with two other vulnerabilities to compromise a phone after a user answered a call.

Which Telegram version fixes the reported issue?

The relevant Android correction is in Telegram 12.10.4, according to NebuSec and the code comparison described in the report. Users should install the latest available version and check the version shown in Settings.

Did the attack happen without the victim doing anything?

No. The report describes an attack that required the victim to answer an incoming call, so it is characterized as a one-click attack rather than a zero-click attack.

Has anyone confirmed real-world attacks?

NebuSec said it had seen no real attacks. The available material does not establish whether the flaw was exploited by anyone else before the disclosure.

Are Telegram on iPhone and desktop affected?

NebuSec said it had no evidence that the iOS or desktop apps, or group calls, were directly affected. The shared calling library received a similar correction, but the available information does not show that those versions were exploitable.

Source: ThorstenMeyerAI.com