Telegram’s Android Call Flaw: Key Facts And Next Steps

🔍 Read the full analysis: Telegram’s Android Call Flaw: Key Facts And Next Steps on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying an attacker could take control of a phone after a user answered a call if the flaw were combined with two other bugs. The company says the reported issue was fixed in Telegram Android version 12.10.4, released in September, and that it has seen no real-world attacks. The full exploit chain has not been documented in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call-code bug alone was not enough for a takeover: an attacker also needed a second bug to escape the Telegram app and a third Android exploit to gain administrator-level, or root, access. The alleged impact could include access to messages, the microphone and the camera.

NebuSec says it tested the chain in private voice calls on ARM64 phones, a chip architecture used by most modern Android phones. Its 22-second demonstration video shows a call connecting before the victim’s phone returns to its home screen and displays a “HACKED BY NEBUSEC” graphic. The clip does not identify the Telegram or Android versions used, and it does not independently establish how the other two bugs worked.

The report says NebuSec notified Telegram on September 26, after version 12.10.4 had been released. Zou said Telegram acknowledged the report but did not believe the flaw could be used for remote code execution; he also said no CVE was assigned and no bounty was paid. Telegram had not issued a public statement in the source material. NebuSec’s research page also did not contain a detailed technical write-up as of October 29.

Why Answering Could Matter

The reported issue highlights a risk in a feature designed to accept data from people a user may not know: incoming calls. If NebuSec’s account of the chain is accurate, answering a call would be the action that exposed a vulnerable Android app to the first bug, while additional vulnerabilities were needed for a full device takeover. That makes the claim different from a zero-click attack, which would not require the user to answer.

For individual users, the practical step is straightforward: update Telegram for Android and check that the app’s version is 12.10.4 or later. Until updated, the source recommends limiting who can call you to My Contacts or Nobody and declining calls from unknown people. Organizations face a separate tracking problem: a vulnerability with no CVE may not appear in tools or policies that rely only on CVE records, so they may need to set and enforce minimum app versions directly.

The limits of the evidence also matter. NebuSec’s claims about the complete chain have not been accompanied by a public technical analysis, and the company’s report of no observed attacks is not proof that the flaw was never exploited. Readers should treat the takeover description as a researcher claim, not as an independently verified account of attacks in the wild.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels

AmazonView Latest Price

LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

What the Version History Shows

Telegram’s Android app source code is publicly available. The source account says a comparison of versions 12.10.3 and 12.10.4 found a change in how the app handles a call status message known as MediaState. Such messages can report microphone status, camera status and video rotation. In version 12.10.3, the code reportedly checked that a rotation value was present but then read a different field; version 12.10.4 reads the rotation field instead. This code comparison supports the existence of a relevant correction, but it does not by itself prove that the change enabled NebuSec’s full attack chain.

The source account also says Telegram’s shared calling library received the same correction on April 21, 2026, in a change titled “Fix camera rotation,” before the Android source containing the fix appeared in September. It reports that iOS incorporated the change in May and desktop in July. NebuSec has not shown that those platforms, or group calls, were directly affected. As of October 29, the U.S. National Vulnerability Database had no CVE entry for the flaw, and the CISA catalog of known exploited vulnerabilities had no Telegram entry.

Those records have limits: the absence of a CVE or catalog listing does not establish that a vulnerability is harmless or that it was never used. The source says NebuSec disclosed the issue on X and that The Hacker News sought comment from Telegram, with no public reply found at the time. Telegram’s own public account of the fix and its security assessment was not available in the material provided.

“Now picking up a wrong call can get you hacked.”

— NebuSec’s October 29 post on X

What the Public Evidence Does Not Show

The key unresolved issue is whether the complete chain works as NebuSec describes. The company has not published a detailed technical write-up of the call flaw or the two additional bugs, and the demonstration does not show the app and operating-system versions on the victim’s phone. The source account says its author could not independently check those other vulnerabilities or test whether the chain works against a current, fully patched Android device.

It is also unclear whether the flaw was exploited before its disclosure. NebuSec says it has seen no real attacks, but that is the company’s observation, not evidence that no attack ever occurred. Telegram’s assessment of the report, the reason it did not assign a CVE, and whether the issue affected other Telegram platforms have not been publicly established in the material provided.

Update Apps and Watch for Detail

Android users should install the latest Telegram release and check the version shown in the app’s Settings; the reported fix is in version 12.10.4 or later. Anyone who cannot update immediately can reduce exposure by changing “Who can call me?” to My Contacts or Nobody and declining calls from unknown callers, according to the source’s advice.

Organizations should check Telegram versions on managed devices rather than relying only on CVE feeds, and set a minimum version for work phones if their policies permit. Further confirmation would depend on a detailed technical account from NebuSec, a public response from Telegram, or independent analysis of the reported exploit chain. Until then, the fix is documented in the app version, while the claimed full-device impact remains not independently confirmed publicly.

Key Questions

Which Telegram Android versions did NebuSec say were affected?

NebuSec said the affected range was versions 8.6.2 through 12.10.3. It identified version 12.10.4 as containing the fix.

Does answering a call alone prove a phone can be taken over?

No. NebuSec said the call-code flaw had to be combined with two additional bugs to gain full control of the device. That account has not been backed by a public technical write-up.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later. Until updated, the source recommends allowing calls only from contacts or nobody and declining calls from strangers.

Is there evidence the flaw was used in real attacks?

NebuSec said it had seen no real attacks. The source material does not establish whether anyone exploited the flaw before disclosure, and the lack of a known report does not prove it never happened.

Were Telegram on iOS or desktop affected?

NebuSec said it had no evidence that iOS or desktop apps, or group calls, were directly affected. The source account reports that those platforms received the shared code correction, but exploitability on them has not been shown.

Source: ThorstenMeyerAI.com