Why Telegram’s Android Call Flaw Has Users Asking Questions

🔍 Read the full analysis: Why Telegram’s Android Call Flaw Has Users Asking Questions on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying it could help an attacker take control of a phone after the user answered a call. Telegram’s version 12.10.4, released in September, contains a correction to the relevant code, but NebuSec’s account of the full attack chain has not been backed by a public technical report, and the company says it has seen no real-world attacks.

NebuSec said the bug affected Telegram for Android versions 8.6.2 through 12.10.3, a range the company dates from March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call-code flaw was only one part of a possible attack: combined with a second bug that leaked information and a third Android root exploit, it could give an attacker broad control over a device. Root access means administrator-level control. NebuSec said that could include access to messages, the microphone and the camera.

The reported route required a person to answer an incoming call. That makes it a one-click attack, rather than a zero-click attack that needs no user action. NebuSec said it tested the chain during private voice calls on ARM64 phones, a processor architecture used by most modern Android phones. The company’s 22-second demonstration shows a call connecting and the victim device returning to its home screen with a “HACKED BY NEBUSEC” graphic. The video does not identify the Telegram or Android versions shown.

A review of Telegram’s public Android source code described in the source material found a change between versions 12.10.3 and 12.10.4 in how call status messages handle a video-rotation value. In the earlier code, the app checked that one field was present but read a different field that might be absent; the later code reads the rotation field. The same correction appeared in Telegram’s shared call library in April, before NebuSec reported the issue in September. That code change supports the existence of a correction, but does not by itself verify NebuSec’s claims about the other bugs or a complete takeover chain.

Why Answering a Call Matters

The issue draws attention to call-handling code, which must process incoming data as a call is being set up. NebuSec’s account says a familiar action—answering a call—could become the point at which a larger attack chain begins. That claim is not the same as evidence that users have been attacked, but it explains why the disclosure matters even with a fix available.

For individual users, the immediate practical question is whether the app is current. NebuSec recommends updating to version 12.10.4 or later and, until then, limiting who can call through Telegram’s privacy settings or declining calls from unknown people. The source says the setting can reduce exposure, but does not establish it as a substitute for installing the update.

The lack of a CVE identifier also complicates security tracking. A company that monitors vulnerabilities only through CVE records may not see this report in those systems. Organizations using Telegram on work phones may want to check app versions directly and set minimum-version requirements, rather than rely solely on vulnerability feeds.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Ninja Foodi 10-Quart DualZone 6-in-1 Air Fryer, Black, DZ302

AmazonView Latest Price

Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Disclosure

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of remote code execution, meaning execution of an attacker’s own code on a device. According to Zou, no CVE was assigned and no bounty was paid. Those details come from NebuSec; no public Telegram statement was identified in the supplied reporting.

The source review found that Telegram’s shared calling library, used by its Android, iOS and desktop apps, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the correction appeared later. The Hacker News reported that iOS incorporated the change in May and desktop in July. Whether the older code was exploitable on those platforms has not been demonstrated, and NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the source material reported no CVE entry for the flaw in the U.S. National Vulnerability Database and no Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, whose cited version was dated October 28. Those absences show that the issue was not listed there at that time; they do not establish that exploitation never occurred.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central unknown is whether the complete attack chain works as described. NebuSec has not published a technical write-up of the flaw in the material provided. The demonstration does not show the app and operating-system versions, and the other two bugs in the alleged chain have not been independently checked in the source review. The reviewer also said they could not test those bugs or establish whether the chain works on a fully patched Android phone.

NebuSec said it had seen no real attacks. That is a statement about the company’s observations, not proof that no one used the flaw. The available material also does not establish how many devices ran affected versions, whether any platform beyond Android was vulnerable, or why Telegram’s shared-library fix appeared months before the Android source change. Telegram’s public response to the report was not available in the source material.

Update and Watch for Detail

Android users should check the Telegram version shown in the app’s Settings and install 12.10.4 or a later release if they have not already updated. NebuSec’s interim advice is to restrict incoming calls to contacts or nobody and avoid answering calls from unknown callers until the app is updated. These steps address the reported exposure; the source does not say that every suspicious call is malicious.

Further clarity depends on a fuller technical account from NebuSec, additional confirmation of the other vulnerabilities in its alleged chain, and a public response from Telegram. Security teams should verify deployed app versions directly, since the issue had no CVE record in the sources checked as of October 29. The status of possible exploitation and any effects on other Telegram platforms remains unresolved.

Key Questions

What is the Telegram Android call flaw?

NebuSec reported a memory-handling bug in Telegram’s Android call code. The source review describes code that checked one message field but then read a different field that could be absent. The reported attack required answering a call and, according to NebuSec, additional bugs.

Which Telegram versions are reported to be affected?

NebuSec identified Android versions 8.6.2 through 12.10.3 as affected and said the issue was fixed in version 12.10.4. The supplied material does not establish a direct impact on iOS, desktop or group calls.

Has Telegram confirmed that users were attacked?

No. NebuSec said it had seen no real-world attacks, and the supplied material identifies no public Telegram statement confirming exploitation. That does not prove the flaw was never used.

What should users do now?

Update Telegram for Android to version 12.10.4 or later. Until updated, NebuSec advises limiting who can call through the app’s privacy settings and declining calls from unknown people.

Does the disclosure prove that answering any unknown call gives an attacker control?

No. NebuSec’s claim is that the call bug, when combined with two other bugs, could enable a takeover. The full chain has not been documented in a public technical report in the supplied material, and the demonstration does not establish that every answered call—or every device—is at risk.

Source: ThorstenMeyerAI.com