Telegram’s Android Call Flaw: A User’s Guide To The Latest Details

🔍 Read the full analysis: Telegram’s Android Call Flaw: A User’s Guide To The Latest Details on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed on Oct. 29 a flaw in Telegram’s Android calling code that it says could be used in a chain of bugs to take control of a phone after its owner answered a call. Telegram had already included a fix in Android version 12.10.4, released in September, but the full exploit chain has not been documented publicly or independently verified.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call bug was not sufficient on its own: combined with a separate information-leak bug and an Android root exploit, it could let an attacker escape the app and gain broad control of a device. The company says the chain worked in private voice calls on ARM64 phones.

The claim describes a one-click attack: a person had to answer the incoming call. It was not described as a zero-click attack, which would require no user action. NebuSec says an attacker needed only a regular Telegram account. It has reported seeing no real-world attacks, but that statement reflects the company’s observations and does not prove the flaw was never used.

Telegram’s Android source code is publicly available. A comparison of versions 12.10.3 and 12.10.4 found a change in call-status handling consistent with the reported bug: the earlier code checked that one field was present, then read a different field that might be absent. The corrected code reads the field it checks. That supports the existence of a code defect, but does not by itself establish that the wider exploit chain worked as described.

Why Answering a Call Matters

Messaging apps must process data from callers before users know whether they trust them. A defect in that call-handling code can make an ordinary action—answering a ring—part of an attack path. In NebuSec’s account, the vulnerable call code was only one link; the claimed access to the whole phone depended on two additional bugs.

For users, the immediate practical step is to update Telegram for Android and check that the installed version is 12.10.4 or later. Until then, NebuSec’s guidance is to restrict who can call to contacts or nobody and to avoid answering calls from unknown accounts. For organizations, the lack of a CVE entry could leave the issue out of security workflows that track vulnerabilities by identifier, making minimum app-version requirements and device policies relevant.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

EcoFlow DELTA 3 Classic Portable Power Station, 1024Wh, 1800W

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Patch Reached Android

NebuSec says it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not think the flaw could be turned into remote code execution. According to Zou, no CVE was assigned and no bounty was paid. Telegram had not issued a public comment in the material available for this report.

The source-code history suggests the correction may have entered Telegram’s shared call library earlier. The same change appeared in the shared tgcalls library on April 21, 2026, under the description “Fix camera rotation.” The Android source with the fix appeared later, on Sept. 24, according to the source material. The Hacker News reported that iOS received the change in May and desktop in July. This timeline does not establish whether those versions were exploitable; NebuSec has not shown that iOS, desktop or group calls were directly affected.

As of Oct. 29, the U.S. National Vulnerability Database had no CVE listing for the flaw, and the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog contained no Telegram entry. The absence of those listings is not evidence that a flaw is harmless or that it was never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Disclosure Does Not Prove

The complete attack chain remains unverified in public technical detail. NebuSec released a short demonstration, but it did not show which Telegram or Android versions the demonstration phones used, and the company’s research page had no full write-up as of Oct. 29. The source material says the demonstration showed a call connecting and the victim phone returning to its home screen, but that alone does not verify every step or the claimed access to messages, microphone and camera.

It is also unclear whether the chain works against a current, fully patched Android installation, whether anyone exploited it before the disclosure, and whether older iOS or desktop builds were vulnerable. NebuSec says it has seen no real attacks; that is not the same as establishing that none occurred. No public Telegram response was available, and the reasons no CVE was assigned are known only through Zou’s account.

Update and Check Your Version

Android users should install the latest Telegram release available for their device and confirm the version shown in the app’s settings is 12.10.4 or later. If an update is not yet available through a particular store or device channel, users can reduce exposure by limiting incoming calls to contacts or disabling them and declining calls from unfamiliar accounts.

Organizations using Telegram on managed phones can check installed versions and set a minimum version requirement rather than relying only on CVE feeds. Further clarity depends on a fuller technical account from NebuSec, a public response from Telegram, or independent analysis of the claimed chain. Until then, the patch is the clearest confirmed practical development, while the broader compromise claims remain attributed to NebuSec.

Key Questions

Which Telegram versions are reported to be affected?

NebuSec says the affected Android versions run from 8.6.2 through 12.10.3. The reported fix is in version 12.10.4.

Did answering a call alone give an attacker full control?

Not according to NebuSec’s description. The company says the call flaw had to be combined with two additional bugs to reach Android and gain broader control. The full chain has not been documented publicly in the source material.

Was this a zero-click attack?

No. The account describes a one-click attack because the user had to answer the incoming call. It was not described as working without user interaction.

Is there evidence the flaw was used in real attacks?

NebuSec says it has seen no real attacks. That is the company’s observation, not proof that exploitation never occurred. The source material reports no public CVE or listing in the U.S. known-exploited-vulnerabilities catalog as of Oct. 29.

What should Android users do now?

Update Telegram to version 12.10.4 or later. Until updated, restrict who can call you to contacts or nobody and avoid answering calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com