What Does Telegram’s Android Call Flaw Mean For Users?

🔍 Read the full analysis: What Does Telegram’s Android Call Flaw Mean For Users? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get hardware and tech essentials delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on Oct. 29, saying an attacker could use it as part of a chain of three bugs to take control of a phone after its owner answered a call. The relevant code was changed in Telegram Android version 12.10.4, released in September, and NebuSec says it has not seen real-world attacks. The disclosure matters most to people using older Android versions, but the full attack chain has not been independently documented in a public technical report.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. It describes a memory-handling bug in code for voice calls. According to the company’s chief executive, Eten Zou, that bug alone was not sufficient to take over a device. It had to be combined with a second flaw that leaked information and a third Android exploit that provided root, or administrator-level, access.

NebuSec says the chain worked in private voice calls on ARM64 phones and required the target to answer the call. That makes the scenario one-click, rather than zero-click: a person had to act, even if answering an incoming call can seem routine. The company says an attacker needed an ordinary Telegram account. It has not shown that group calls, Telegram’s iOS app or desktop apps were directly affected.

The source account says a comparison of Telegram’s public Android code for versions 12.10.3 and 12.10.4 found a change consistent with the flaw described. In the earlier code, the app checked that a video-rotation field was present but then read a different field that might be missing; the later version reads the rotation field. That comparison supports the existence of a relevant code change, but does not by itself establish that the entire three-bug attack worked as described.

Why Answering a Call Matters

If NebuSec’s account is accurate, the weakness shows how an ordinary app action could be used as an entry point when a vulnerable call-handling component is combined with other flaws. Answering an unfamiliar call would not itself prove that a device was compromised, and the reported takeover depended on a chain rather than this bug alone. Still, the claim gives Android users with older Telegram versions a practical reason to update.

The disclosure also highlights a visibility problem for organizations. The source says the flaw has no CVE number, and it does not appear in the U.S. government’s known-exploited-vulnerabilities catalog as of Oct. 28. Security teams whose tools rely on CVE identifiers may not flag a fix automatically. Organizations can reduce that gap by tracking minimum app versions on work devices and applying their own messaging-app policies.

For individual users, the key distinction is between a reported vulnerability and confirmed exploitation. NebuSec says it has seen no real attacks; that is not proof that no one ever used the flaw. The available information supports checking and updating the app, but it does not establish that every Telegram call, or every older Android phone, was exposed to a successful attack.

Products Worth Considering

Ledger Flex + Folio Crypto Hardware Wallet

AmazonView Latest Price

Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predated the Disclosure

NebuSec said it reported the issue to Telegram on Sept. 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be turned into remote code execution. According to Zou, no CVE was assigned and no bounty was paid. These details are attributed to the company; a public Telegram response was not found in the source account.

The source’s review of Telegram’s public code also found that a shared call library received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android code with the correction appeared later, while The Hacker News reported that iOS and desktop apps incorporated the shared change in May and July. The existence of related changes does not establish that those platforms were exploitable, and NebuSec did not claim direct impact on them.

As of Oct. 29, the source account reported no CVE entry in the U.S. National Vulnerability Database and no Telegram listing in the CISA catalog of known exploited vulnerabilities, using the catalog version dated Oct. 28. Those absences describe the public records checked at that time; they do not determine whether a vulnerability exists or whether an attack occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the flaw on X

What the Public Evidence Cannot Show

The complete exploit chain remains unverified in a public technical write-up. The source says NebuSec’s brief video shows a victim phone responding to a call and then displaying a takeover message, but it does not identify the Telegram or Android versions on that device. The source also says the video does not demonstrate the two additional bugs in enough detail to assess how they were combined.

It is not clear whether the chain works on a current, fully patched Android phone, whether any attacker used the flaw before disclosure, or whether related code in iOS and desktop versions could be exploited. NebuSec says it has seen no real attacks, but that is not the same as proving none occurred. Telegram’s public response and its explanation for the earlier code change were also unavailable in the source material.

Check the App and Call Settings

Android users should check Telegram’s version in Settings and update to 12.10.4 or later if they are running an older release. Until updated, the source recommends setting “Who can call me?” to My Contacts or Nobody and declining calls from unknown people. Those steps reduce exposure to the reported call scenario but do not replace updating the app.

Organizations using Telegram on work phones can check installed versions and set a minimum version requirement. The next useful developments would be a detailed technical account from NebuSec, a public response from Telegram, or further evidence clarifying whether the reported chain affected other platforms or was used in attacks. Until then, the disclosed call-code fix is confirmed in the version comparison described by the source, while the broader takeover claim remains attributed to NebuSec.

Key Questions

Which Telegram Android versions does NebuSec say were affected?

NebuSec says the affected range was versions 8.6.2 through 12.10.3. The relevant code was changed in version 12.10.4, released in September 2026.

Could the flaw hack a phone without the user doing anything?

According to NebuSec, the target had to answer an incoming call, so the reported scenario was one-click, not zero-click. The company says the call flaw also needed two other bugs to enable a full takeover.

Has NebuSec reported real-world attacks?

NebuSec says it has seen no real attacks. That is the company’s account and does not prove that no one used the flaw.

Are Telegram on iPhone or desktop computers confirmed to be affected?

No. The available account says NebuSec had no evidence that iOS, desktop apps or group calls were directly affected. A shared call-library change appeared in other versions, but that alone does not show they were exploitable.

What should Telegram users do now?

Check the Telegram Android version in Settings and update to 12.10.4 or later. Until updated, restrict incoming calls to My Contacts or Nobody and decline calls from unknown people.

Source: ThorstenMeyerAI.com