Telegram’s Android Flaw: Key Questions And What To Do Now

🔍 Read the full analysis: Telegram’s Android Flaw: Key Questions And What To Do Now on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed on October 29 a memory-handling flaw in Telegram for Android that it says could help attackers take control of a phone after a user answers a call. Telegram’s version 12.10.4 includes a fix for the call-code issue, according to NebuSec; users on older versions should update and can restrict who is allowed to call them while checking their app version.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company described the issue as one part of a three-bug chain: the call bug, combined with another flaw that leaked information and an Android root exploit, could allow an attacker to move beyond Telegram and gain broad control of the phone. The reported attack required the victim to answer an incoming call, making it a one-click scenario rather than an attack that works without user action.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 Android phones. NebuSec also posted a short demonstration video, but the video does not identify the Telegram or Android version shown. The company has not published a technical write-up of the flaw or the other two components, leaving the full chain dependent on its account and demonstration.

The Android app’s public source code offers evidence of a fix to the call-handling code. Comparing versions 12.10.3 and 12.10.4, the source changes how the app reads a video rotation value in a call-status message. The earlier code checked that one field existed, then read a different field that might not be present; the later code reads the checked field. That source change supports the presence of a corrected coding error, but it does not by itself establish that the entire attack chain works as described.

Why Answered Calls Raise Risk

Calls from unknown accounts can prompt a quick, ordinary response: users may answer before deciding whether they trust the caller. If NebuSec’s account of the exploit chain is accurate, that interaction could expose more than a Telegram account, reaching the device itself. A compromised phone could put private messages and access to the microphone or camera at risk, though NebuSec has not supplied public technical evidence that verifies those outcomes independently.

The disclosure also highlights a practical challenge for organizations. A software fix may be available without a CVE identifier, a standard vulnerability-tracking number used by many security teams and tools. Companies that rely only on CVE alerts could miss the issue. For work devices, administrators should check Telegram versions directly, set a minimum app version where possible, and define rules for messaging apps on managed phones.

For individual users, the immediate actions are straightforward: install Telegram 12.10.4 or later, verify the version shown at the bottom of Settings, and temporarily limit incoming calls to contacts or nobody if the app cannot yet be updated. Declining unexpected calls reduces exposure to the scenario NebuSec described, but it is not a substitute for installing the fix.

Products Worth Considering

DJI Osmo Mobile 7P Phone Gimbal with Mic Mini Transmitter, Infinity Black

AmazonView Latest Price

Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black

AmazonView Latest Price

DJI Mini 5 Pro Fly More Combo Plus with DJI RC 2

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Android Fix Emerged

NebuSec said it reported the issue to Telegram on September 26, after version 12.10.4 had already appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of being turned into remote code execution. According to Zou, no CVE was assigned and no bug bounty was paid. The source material reports no public response from Telegram to The Hacker News’ request for comment.

The Android code change may have originated earlier in Telegram’s shared call library. The source review described in the report found a similar correction in tgcalls on April 21, 2026, under the title “Fix camera rotation.” The Android source containing the fix appeared on September 24, according to that review. The Hacker News reported that iOS incorporated the change in May and desktop in July, but the available information does not show whether those older app versions were exploitable.

As of October 29, the U.S. National Vulnerability Database had no CVE entry for the flaw, and the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry for it. These absences do not prove that no attack occurred; they indicate that the issue was not listed in those records at the time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post announcing the flaw

What the Public Evidence Shows

The Android source comparison supports that Telegram corrected a call-code error, but the full three-bug chain remains unverified publicly. The source material says the two additional bugs were not independently checked, and the demonstration does not disclose the victim phone’s software versions. It is also unclear whether the chain would work on a current, fully patched Android device.

NebuSec said it had seen no real-world attacks. That is a report from the company, not proof that the flaw was never used. There is no CVE number or public technical write-up in the information available as of October 29, and no public Telegram statement was identified. The company’s claim that iOS and desktop apps, or group calls, were not directly affected has not been established through a published independent assessment.

Update Apps and Watch for Findings

Users should update Telegram for Android to 12.10.4 or later and confirm the installed version in Settings. Until updated, set “Who can call me?” to My Contacts or Nobody and decline unexpected calls. Organizations should check managed devices for outdated installations rather than relying solely on vulnerability feeds that require a CVE.

The next useful developments would be a technical account from NebuSec, a public response from Telegram, or independent analysis of the exploit chain and affected platforms. Until such information is available, the confirmed point is narrower than the strongest claim: Telegram’s Android call code was changed in the fixed release, while the reported route from answering a call to full device control remains a claim that lacks public technical validation.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said versions 8.6.2 through 12.10.3 were affected and identified 12.10.4 as the fixed version. Update to 12.10.4 or later and check the version in Telegram’s Settings.

Does the reported attack work without answering a call?

According to NebuSec, the victim had to answer an incoming call. The company described the scenario as one-click, not zero-click. The full exploit chain has not been documented publicly.

Is there evidence the flaw was used in real attacks?

NebuSec said it had seen no real attacks. That is the company’s account; the available information does not establish whether the flaw was never exploited.

Are Telegram on iPhone and desktop affected?

The source material reports no evidence that the iOS or desktop apps were directly affected, and says their shared call code received a similar change earlier. Exploitability on those platforms has not been shown, so the issue remains unresolved.

What should I do if I cannot update right away?

Set “Who can call me?” to My Contacts or Nobody and decline calls from unfamiliar accounts until you can install the updated app. For work phones, ask the administrator whether a minimum app version is required.

Source: ThorstenMeyerAI.com