Telegram’s Android Call Flaw: Questions Users May Have

🔍 Read the full analysis: Telegram’s Android Call Flaw: Questions Users May Have on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could use it as part of a three-bug chain to take control of a phone after its owner answered a call. The company says Telegram fixed the reported call-code bug in Android version 12.10.4, released in September, and that it has seen no real-world attacks; the complete exploit chain has not been documented in a public technical report.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering a period from March 2022 to September 2026. The company’s chief executive, Eten Zou, told The Hacker News that the call bug was not sufficient on its own: an attacker also needed a second bug to escape the app and an Android root exploit to gain administrator-level control of the device. The claimed outcome included access to messages, the microphone and the camera.

The attack described by NebuSec was one-click, not zero-click: the target had to answer an incoming call. NebuSec said it tested the chain in private voice calls on ARM64 phones, a processor architecture common in modern Android devices. Its short demonstration video shows a call connecting before the victim phone returns to its home screen, but the video does not identify the Telegram or Android versions used.

The source material reports that NebuSec notified Telegram on September 26, after version 12.10.4 had appeared. Zou said Telegram acknowledged the report but did not believe the issue could be used for remote code execution. According to the account, no CVE identifier was assigned and no bounty was paid. The report says no public response from Telegram was found. The US National Vulnerability Database had no CVE entry for the flaw as of October 29, and the CISA known-exploited-vulnerabilities catalog dated October 28 did not list it.

Why Answering a Call Matters

The reported weakness concerns code that processes call-status data, not a link or file that a user must open. That matters because a person may answer an unfamiliar call without expecting it to expose the phone to a software attack. In the scenario NebuSec describes, answering was the user action that allowed the exploit chain to proceed.

For individual users, the clearest practical step is to install Telegram 12.10.4 or later and verify the app’s version in Settings. NebuSec’s disclosure also recommends limiting who can call an account to contacts or nobody until the app is updated, and declining calls from unknown people. These precautions reduce exposure to the described route; they do not establish that every call from a stranger is malicious or that the flaw was exploited in the wild.

The case also raises a software-management issue for employers. Security tools that track vulnerabilities only through CVE identifiers may not flag a flaw with no CVE. The source account suggests companies set minimum app versions on work phones and establish rules for messenger use. That is relevant because an installed update may not be applied promptly across a workforce.

Products Worth Considering

Dell 34-Inch S3425DW Curved WQHD USB-C Monitor

AmazonView Latest Price

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix and Its Code History

Telegram publishes the source code for its Android app. The source account says a comparison of versions 12.10.3 and 12.10.4 found a change in how call messages are handled. A MediaState message can report microphone status, camera status and video rotation. In version 12.10.3, the code reportedly checked that a rotation value existed but then read a different field, video state, which the message did not have to include. In version 12.10.4, it reads the rotation field instead.

The account also reports that Telegram’s shared call library, tgcalls, received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source carrying the correction appeared later, on September 24, according to the account’s code review. The Hacker News was cited as reporting that iOS incorporated the change in May and desktop in July. Those dates do not by themselves show that the other platforms were exploitable.

NebuSec’s public disclosure included a short video, but the source account said its research page did not yet contain a technical write-up. The description of the additional information-leak and root-exploit bugs therefore comes from Zou’s statements to The Hacker News rather than a published, reproducible account of the complete chain.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The full attack chain remains unverified publicly in the material described here. NebuSec’s video does not show the affected app or operating-system versions, and the company had not published a technical write-up as of October 29. The source account says its author could inspect Telegram’s Android code change but could not independently check the two additional bugs, test the chain on a fully patched Android phone or determine whether anyone used it before disclosure.

NebuSec said it had seen no real-world attacks. That is a statement about what the company has observed, not proof that no attacks occurred. The lack of a CVE and the absence of an entry in the cited CISA catalog likewise do not establish that the flaw was harmless or exploited; they describe the available public tracking at the dates checked.

NebuSec reported no evidence that Telegram’s iOS or desktop apps, or group calls, were directly affected. The shared-library history makes the issue worth examining across platforms, but the source material does not establish that the vulnerable code was exploitable on those versions. Telegram had not issued a public comment in the account provided.

Update, Then Watch for Details

Android users should check Telegram’s version in Settings and update to 12.10.4 or later if they are running an older release. Until updated, users can restrict incoming calls to contacts or disable them, as NebuSec suggested. These steps address the reported exposure while more technical details remain unavailable.

The next useful developments would be a public technical account from NebuSec, a response from Telegram clarifying the fix and platform scope, or independent analysis of the full exploit chain. Until such evidence appears, the confirmed public record is narrower than the company’s most serious claim: a reported Android call-code flaw was fixed, while the alleged device takeover depended on additional bugs that have not been publicly detailed in the source material.

Key Questions

Does answering a Telegram call automatically hack an Android phone?

No. NebuSec described a flaw that it said could be used in an attack chain after a person answered a call. Its account also required two additional bugs; the disclosure does not show that answering any call automatically compromises a phone.

Which Telegram Android versions did NebuSec identify?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and version 12.10.4 as containing the fix. Users should check the version shown in Telegram’s Settings and install a current release.

Were attacks observed in the wild?

NebuSec said it had seen no real-world attacks. That does not establish that no one ever exploited the issue; the source material does not provide independent evidence about prior use.

Are Telegram on iPhone or desktop affected?

The source account says NebuSec had no evidence that iOS or desktop apps were directly affected, and it does not establish that the vulnerability worked on those platforms. A shared call-library correction was reported across versions, but that alone is not proof of exploitability.

What should users do if they cannot update immediately?

NebuSec recommended setting “Who can call me?” to My Contacts or Nobody and declining calls from strangers until the app is updated. Those measures limit incoming calls but do not replace installing the fix.

Source: ThorstenMeyerAI.com