Telegram Android Security: What To Know About The Call Flaw

🔍 Read the full analysis: Telegram Android Security: What To Know About The Call Flaw on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying that answering a call could start an attack that, when combined with two other bugs, gave an attacker control of a phone. Telegram had already included a correction in Android version 12.10.4, released in September, according to NebuSec; the company said it had seen no real-world attacks.

NebuSec said the vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company described the call flaw as one part of a chain: a second bug allegedly helped an attacker escape the Telegram app into Android, and a third Android root exploit allegedly granted administrator-level access. NebuSec said an attacker needed an ordinary Telegram account and that its testing covered private voice calls on ARM64 phones.

The publicly described evidence is limited. NebuSec announced the issue on X with a short demonstration video, but the video does not identify the Telegram or Android versions shown. As of October 29, the company’s research page had no technical write-up of the vulnerability. The details of the other two bugs and the full exploit chain therefore rest on NebuSec’s account and the demonstration, rather than a public, independently reproducible report.

NebuSec chief executive Eten Zou told The Hacker News that Telegram acknowledged the report after it was sent on September 26, but did not believe the issue could be turned into remote code execution, the running of an attacker’s code on a device. Zou said no CVE identifier was assigned and no bug bounty was paid. The source material reports no public Telegram response to the publication’s request for comment.

Why Answering a Call Matters

The reported attack depends on a user answering an incoming call, making it a one-click scenario rather than a zero-click attack. That distinction matters: the user must take an action, but answering an unfamiliar call is routine, and the call feature is designed to receive data from someone who may not be in the user’s contacts.

If the full chain works as NebuSec describes, the consequence could go beyond a problem inside the messenger: root access can expose a device’s data and capabilities. However, that impact is a company claim, not a conclusion established by a published technical analysis. The disclosure still gives Android users a practical reason to update and gives organizations a reminder that app security fixes may not appear in vulnerability feeds when no CVE is assigned.

Products Worth Considering

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

Dell UltraSharp 32 U3226QER 4K Thunderbolt Hub Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

Telegram’s public Android source code offers one check on the reported call-code issue. The source material says a comparison of versions 12.10.3 and 12.10.4 found that the earlier version checked whether a camera-rotation value was present, then read a different video-state field that might be missing. Version 12.10.4 instead reads the rotation field. That code change is consistent with a correction in the call-handling path, though the code comparison alone does not establish that the flaw enabled the full takeover NebuSec alleges.

The source material also says Telegram’s shared calling library received the same correction on April 21, 2026, under a change titled “Fix camera rotation,” months before the Android update. The Hacker News reported that iOS incorporated the change in May and desktop in July. Those dates show the correction reached other clients, but do not establish that those apps were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the U.S. National Vulnerability Database had no CVE entry for the flaw, and the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, dated October 28, had no Telegram entry for it. The absence of a listing is not evidence that an exploit was never used; it means those records do not list this issue.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Exploit Details Still Unverified

Several central points remain unsettled: whether the complete chain works on a current, fully patched Android phone; the technical details and independent status of the two additional bugs; and whether anyone exploited the issue before disclosure. NebuSec said it had seen no real attacks, but that statement cannot establish that none occurred. The demo does not disclose the victim device’s software versions, and no public technical report currently allows outside researchers to reproduce the chain.

It is also unclear whether the shared-library correction reflects a security fix or a camera-function change. The source material says the code was corrected before NebuSec reported the issue, but does not establish Telegram’s reasoning or whether the company knew of a security risk at that time. No CVE has been assigned, and there is no public Telegram statement in the material available for this report.

Check the App Version Now

Android users should update Telegram and check the version number shown at the bottom of the app’s Settings screen. The cited fix is in version 12.10.4 or later. If an update is not yet available on a device, NebuSec’s guidance is to restrict “Who can call me?” to My Contacts or Nobody and avoid answering calls from unknown accounts until the app is updated.

Organizations managing work phones can set a minimum permitted app version and establish rules for using messaging apps, particularly where device access could expose work data. Further clarity depends on a public technical report, Telegram’s response, or independent analysis of the reported exploit chain. Until then, the fix is documented in the app version, while the alleged full-device takeover remains attributed to NebuSec.

Key Questions

Which Telegram Android versions did NebuSec say were affected?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the correction is in version 12.10.4. The claim concerns Telegram for Android.

Does the reported attack work without the user doing anything?

No. As described by NebuSec, the user must answer the incoming call. The company characterized it as a one-click attack, not a zero-click attack.

Has Telegram confirmed the full attack chain?

The available source material reports no public Telegram confirmation. NebuSec said Telegram acknowledged its report but disputed that the call bug could enable remote code execution. The complete chain has not been detailed in a public technical write-up.

What should Android users do?

Update Telegram to version 12.10.4 or later and verify the installed version in Settings. If unable to update immediately, NebuSec recommends limiting who can call the account and declining calls from strangers.

Were attacks observed in the wild?

NebuSec said it had seen no real-world attacks. That is the company’s report, not proof that no attacks occurred; the available material does not independently establish whether the flaw was ever exploited.

Source: ThorstenMeyerAI.com