A Question Of Calls: Telegram’s Android Flaw And What Comes Next

🔍 Read the full analysis: A Question Of Calls: Telegram’s Android Flaw And What Comes Next on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying it could be combined with two other bugs to give an attacker full control of a phone after a user answered a call. Telegram had already corrected the relevant code in Android version 12.10.4, released in September, but the reported attack chain has not been independently documented in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. The company said the call-code bug alone was insufficient: paired with an information-leak bug, it could help an attacker escape the app, while a third Android exploit could provide administrator-level access. NebuSec said the attacker needed a Telegram account and the victim had to answer the call, making the described method one-click rather than zero-click.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 phones. A short demonstration video posted with the disclosure shows a call connecting and the victim phone displaying a takeover message, but it does not identify the Telegram or Android versions used. NebuSec’s research page had no detailed technical write-up as of October 29, so the components of the claimed chain cannot be fully checked from the public material described in the source.

A comparison of Telegram’s public Android code for versions 12.10.3 and 12.10.4 found a change in how call status messages are handled. The earlier code checked that a camera-rotation value existed but then read a different field, which could be absent; the later code reads the rotation field. NebuSec said it had seen no real-world attacks. The disclosure also reported no CVE number, and the flaw was not listed in the US catalog of known exploited vulnerabilities as of October 29.

Why Answered Calls Matter

The reported issue concerns a feature that must process incoming data from another account while a call is being set up. That makes calls a potential entry point: a recipient may need to do no more than answer a ring before the app handles the relevant data. In this case, however, NebuSec says that additional vulnerabilities were required for a complete takeover; the call bug should not be described as independently granting full access.

For users, the practical step is straightforward: update Telegram for Android and check that the installed version is 12.10.4 or later. Until updated, NebuSec’s guidance is to restrict who can call you to contacts or nobody and to decline calls from unknown accounts. For organizations, the episode illustrates a visibility gap: security tools that rely only on CVE tracking may not flag a software fix that has no CVE identifier. App-version requirements and clear messaging-app policies can help administrators manage that risk.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black

AmazonView Latest Price

Dyson Cyclone V10 Origin Cordless Vacuum

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

A Fix Before Public Disclosure

NebuSec said it reported the flaw to Telegram on September 26, shortly after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not think the issue could be turned into remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material reports no public response from Telegram.

Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the correction appeared later, according to the code comparison described in the source. The Hacker News reported that iOS and desktop apps also received the change in May and July, respectively. NebuSec said it had no evidence that those apps or group calls were directly affected; the available account does not establish whether the older code was exploitable on those platforms.

There is a relevant distinction between a code change and a confirmed security incident. The correction is visible in public source code, while the broader claim of a three-bug takeover chain comes from NebuSec’s disclosure and statements. As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the US Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog had no Telegram entry.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The available information does not establish whether anyone exploited the flaw outside NebuSec’s testing. The company said it had not seen real attacks, which does not prove that none occurred. The source material also says the demo does not show the victim’s software versions and that NebuSec had not published a technical write-up by October 29.

The two additional bugs in the alleged chain, the chain’s operation on a fully patched Android phone, and the effect of the earlier code on iOS or desktop remain unverified in the public account. There is also no CVE entry to provide a standard vulnerability record. These gaps limit independent assessment of the claim, even though the Android code correction itself can be examined.

Update Android and Watch for Details

Android users should check Telegram’s version in Settings and install 12.10.4 or later if an update is available. Users who cannot update immediately can limit incoming calls to contacts or disable them, as NebuSec advised. Organizations using Telegram on work phones can set minimum app versions and review their messaging-app policies.

The next useful evidence would be a detailed technical account from NebuSec, including the conditions and software versions needed for each part of the alleged chain. A public response from Telegram could clarify its assessment, the reason no CVE was assigned, and whether the correction was intended as a security fix. Until then, the code change is confirmed in the comparison described by the source, while the full takeover scenario and any prior exploitation remain claims or unknowns.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said versions 8.6.2 through 12.10.3 were affected. It identified version 12.10.4 as including the correction.

Could an attacker take over a phone just by calling?

Not according to the description of the full chain. NebuSec said the call-handling flaw had to be combined with two additional bugs, and the user had to answer the call. The chain has not been fully documented in a public technical report in the source material.

Has NebuSec reported real-world attacks?

No. NebuSec said it had seen no real attacks. That is not proof that the flaw was never used, and the source material does not independently establish whether exploitation occurred.

Were Telegram’s iOS and desktop apps affected?

The source says NebuSec had no evidence that iOS, desktop, or group calls were directly affected. The shared call library received a similar correction, but whether the old code was exploitable on those platforms has not been shown.

What should Telegram users do now?

Update Telegram for Android and check that the installed version is 12.10.4 or later. Until updated, NebuSec advised limiting calls to contacts or nobody and declining calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com