What To Ask About Telegram’s Android Call Vulnerability

🔍 Read the full analysis: What To Ask About Telegram’s Android Call Vulnerability on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a vulnerability in Telegram’s Android calling code on October 29, saying an attacker could combine it with two other bugs to gain control of a phone after its owner answered a call. Telegram had already released Android version 12.10.4 with a code change related to the flaw, according to NebuSec and a review of Telegram’s public source code; the full attack chain has not been independently documented in a public technical report.

NebuSec said the affected range was Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company said the call-code flaw was only one part of a larger chain: a second bug allegedly exposed information needed to escape the app, while a third Android exploit allegedly provided root access, or administrator-level control. On that account, an attacker would need the recipient to answer, making the described scenario one-click rather than zero-click.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the attack in private voice calls on ARM64 phones. The publication showed a short demonstration video released by NebuSec, but it did not establish which app or Android versions were running on the victim phone. As of October 29, NebuSec had not published a detailed technical write-up of the flaw or the other two alleged vulnerabilities. The company said it had seen no real-world attacks; that does not establish whether the bug was never exploited.

A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 shows a change in how call-status messages handle a video rotation value. The earlier code checked that one field existed but read a different field that might be absent; the later version reads the rotation field. That supports the existence of a relevant code correction, but does not by itself verify NebuSec’s claims about app escape, root access or the complete attack chain. Telegram had not issued a public statement in the source material, and the flaw had no CVE number as of October 29.

Why Answering a Call Matters

Messaging apps must process incoming call data before users have established who is calling or whether they trust them. If NebuSec’s account is accurate, the weakness turned an ordinary action—answering a call—into the entry point for a chain that could reach beyond Telegram and compromise the device. That would put more than chat content at risk: a phone controlled at the operating-system level could expose sensitive data and device functions.

For users, the immediate practical step is straightforward: update Telegram for Android and check that Settings shows version 12.10.4 or later. Until updated, NebuSec’s guidance is to restrict “Who can call me?” to My Contacts or Nobody and decline calls from unknown people. The advice is precautionary; the company says it has not seen attacks in the wild.

The report also presents a visibility problem for organizations. A flaw with no CVE may not appear in security tools and processes that track vulnerabilities by that identifier. Companies using work phones may need to set minimum app-version requirements and define which messaging services are permitted, rather than relying only on vulnerability feeds.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black

AmazonView Latest Price

Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Patch Before the Disclosure

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of remote code execution; he said there was no CVE assignment or bounty. The source material says Telegram did not publicly respond to a request for comment.

Telegram’s public code history adds a complication to that timeline. Its shared calling library, used by Android, iOS and desktop apps, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The corrected Android source appeared later, in September. The source material reports that iOS incorporated the change in May and desktop in July, but does not establish that those apps were exploitable. A code correction in shared call software is not, on its own, proof that every platform faced the same security risk.

As of October 29, the U.S. National Vulnerability Database had no CVE entry for the issue, and the version of CISA’s known exploited vulnerabilities catalog dated October 28 listed no Telegram entry. Those absences describe the public records at that time; they do not establish that the flaw was harmless or never used.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central unresolved issue is whether the entire attack chain works as NebuSec describes. The public source comparison supports a change in call-status handling, while the additional information-leak and Android root-exploit components have not been independently demonstrated in a detailed public analysis. The demonstration video does not identify the victim phone’s Telegram or Android versions.

It is also not clear whether a fully updated Android device could still be affected through another part of the reported chain, whether anyone exploited the issue before disclosure, or whether versions of Telegram for iOS and desktop were vulnerable. NebuSec reported no evidence of real attacks, but absence of observed attacks is not proof that none occurred. Telegram’s public explanation of the patch and its assessment of the report were not available in the source material.

Update and Watch for Verification

Android users should install Telegram version 12.10.4 or later and confirm the version shown in the app’s Settings. Those who cannot update immediately can restrict incoming calls to contacts or disable them, and avoid answering calls from unfamiliar accounts. Organizations should check device compliance and consider whether their mobile policies require an approved minimum app version.

The next useful developments would be a technical report from NebuSec, a public response from Telegram, or independent analysis of the alleged companion bugs and cross-platform code. Until those details emerge, the confirmed point is narrower than the full claim: Telegram’s Android call code changed in the fixed release, while the account of a complete route to device takeover remains attributed to NebuSec.

Key Questions

Which Telegram Android versions does NebuSec say were affected?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the issue was fixed in version 12.10.4. Users should check for the latest available app update rather than rely on an old installation.

Did the vulnerability allow someone to hack a phone without the user doing anything?

Not according to NebuSec’s description. The company said the recipient had to answer the incoming call, so it characterized the scenario as one-click, not zero-click. The full chain has not been independently documented in a public technical report.

Is there evidence that attackers used the flaw?

NebuSec said it had seen no real-world attacks. The source material reports no CVE entry or listing in CISA’s known exploited vulnerabilities catalog as of October 29, but those facts do not prove the flaw was never exploited.

Were Telegram on iPhone or desktop also vulnerable?

NebuSec said it had no evidence that iOS or desktop apps were directly affected. A related correction appeared in shared call software used across platforms, but that code history does not establish that those versions were exploitable.

What should Telegram users do now?

Update Telegram for Android to 12.10.4 or later. Until updated, restrict who can call you to My Contacts or Nobody, and decline calls from unfamiliar accounts, following NebuSec’s precautionary guidance.

Source: ThorstenMeyerAI.com