How To Understand Reports About Telegram’s Android Call Flaw

🔍 Read the full analysis: How To Understand Reports About Telegram’s Android Call Flaw on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could exploit it after a user answered a call if the flaw was combined with two other bugs. The reported call-code issue was fixed in Telegram Android 12.10.4, released in late September; the full chain and claims of device takeover have not been independently detailed in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range it dates from March 2022 to September 2026. The company says the bug was in the app’s voice-call code and that a successful attack required the target to answer an incoming call. That makes the reported scenario a one-click attack, not an attack requiring no user action.

NebuSec chief executive Eten Zou told The Hacker News that the call flaw alone was insufficient. According to Zou, an attacker could combine it with a second bug that leaked information and a third Android root exploit, which grants administrator-level control. NebuSec says the chain could then expose messages, the microphone and the camera. It says the demonstration involved private voice calls on ARM64 phones, a processor architecture used by most modern Android phones.

The public evidence remains limited. NebuSec posted a short demonstration video, but it does not identify the Telegram or Android versions on the target phone. As of October 29, the company had not published a technical write-up explaining the complete exploit chain. The source material reports that Telegram’s public Android code contains a correction between versions 12.10.3 and 12.10.4, but that code comparison does not independently verify the other two bugs or the claimed full-device compromise.

Why Answering a Call Matters

The reported issue matters because calls are designed to accept connection data from another account before a recipient has decided whether to trust the caller. If NebuSec’s account is accurate, answering an unfamiliar call could have served as the user action needed to start a larger exploit chain on an unpatched Android phone. The report does not establish that every call, or every Telegram user, was at risk.

For individual users, the practical response is straightforward: update Telegram and check that the version shown in Settings is 12.10.4 or later. Until updated, the source recommends limiting “Who can call me?” to My Contacts or Nobody and declining calls from unknown accounts. Those steps reduce exposure to incoming calls; they do not establish whether a particular device was targeted.

The lack of a CVE also has implications for organizations. Security teams that rely only on vulnerability identifiers may not see this issue in their usual tracking systems. Companies using Telegram on work phones may need to set a minimum app version and define which messaging apps are permitted. NebuSec says it has seen no real attacks, but that statement is not proof that exploitation never occurred.

Products Worth Considering

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec said it reported the issue to Telegram on September 26, after Android version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not agree that the bug could be used for remote code execution. The source says no CVE was assigned and no bug bounty was paid. It also reports that The Hacker News sought comment from Telegram and that no public response had been found by October 29.

A comparison of Telegram’s published Android source code described in the source material found a change to how call status messages are handled. The earlier code checked that a camera-rotation value existed but then read a separate video-state field; version 12.10.4 reads the rotation field instead. The source characterizes this as matching the reported bug, while the change itself is not proof of NebuSec’s full exploit-chain claims.

The same source says Telegram’s shared call library received a related correction on April 21, 2026, in a change titled “Fix camera rotation.” It reports that iOS and desktop versions later incorporated the change, but there is no demonstrated evidence in the supplied material that those apps were exploitable. The National Vulnerability Database had no CVE entry for the flaw as of October 29, and the CISA known-exploited-vulnerabilities catalog dated October 28 had no Telegram entry.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central uncertainty is the gap between the visible code correction and NebuSec’s broader claim that three bugs could lead to full control of an Android phone. The source material says the call-code change can be checked in Telegram’s published source, but no public technical write-up establishes how the other two bugs work or how the chain proceeds on a device.

It is not clear whether the exploit works against a current, fully patched Android system, which Android versions or specific devices were affected, or whether anyone used the flaw before disclosure. NebuSec says it has seen no real attacks; that is the company’s observation, not confirmation that no attacks happened. The absence of a CVE or a CISA catalog listing also does not determine whether a vulnerability is real or whether it was exploited.

The supplied information does not establish direct exposure in Telegram’s iOS or desktop apps, or in group calls. The shared library change and later app updates are relevant background, but they do not by themselves show those versions were vulnerable. Telegram had not provided a public account in the reporting described here.

Updates and Technical Disclosure

Users should install the latest Telegram Android release available to them and verify that the app is at least version 12.10.4. People unable to update immediately can restrict incoming calls in Telegram’s privacy settings, as described in the source material. Organizations should check installed versions on managed phones rather than relying only on CVE feeds.

Further clarity depends on whether NebuSec publishes technical details and whether Telegram comments on the report or explains the timing and purpose of the code change. A public analysis could help establish the affected conditions, the role of Android’s security protections and whether the claimed chain works on patched devices. Until then, the reported Android call-code bug has a documented software fix, while the wider takeover claim and the history of any exploitation remain unverified publicly.

Key Questions

What is the reported Telegram Android flaw?

NebuSec describes a memory-handling flaw in Telegram’s Android voice-call code. The company says it could be combined with two other bugs to compromise a phone after the user answered a call. The full chain has not been explained in a public technical report in the supplied material.

Which Telegram version fixes the reported issue?

The reported fix is in Telegram for Android 12.10.4. Users should check the version displayed in the app’s Settings and install a later release if one is available.

Was this a zero-click attack?

No. The scenario described by NebuSec required the user to answer an incoming call, so it is described as one-click rather than zero-click. The source does not establish that simply receiving a call was enough to trigger the reported chain.

Is there evidence the flaw was exploited?

NebuSec said it had seen no real attacks. The source material reports no CVE or CISA known-exploited-vulnerability listing as of October 29, 2026. Those points do not prove that exploitation never occurred.

Are Telegram on iPhone and desktop affected?

The supplied information does not show that the iOS or desktop apps, or group calls, were directly exploitable. It says related code was updated in those apps, but direct exposure has not been demonstrated.

Source: ThorstenMeyerAI.com