What We Know So Far About Telegram’s Android Flaw

🔍 Read the full analysis: What We Know So Far About Telegram’s Android Flaw on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android voice-call code on October 29, saying it could help an attacker take control of a phone after the user answered a call. Telegram had already included a code correction in Android version 12.10.4, released in September, but the full attack chain has not been independently documented in a public technical report.

NebuSec says the vulnerable code affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company says the call-related bug was one part of a three-bug chain: a second flaw allegedly exposed information needed to escape the Telegram app, while a third Android exploit provided root access, or administrator-level control. NebuSec says that chain could expose messages and enable access to the phone’s microphone and camera.

The flaw was not described as zero-click: in NebuSec’s account, the victim had to answer an incoming call. The startup says it demonstrated the attack in private voice calls on ARM64 phones, a processor architecture used by most modern Android devices. Its 22-second video shows a call connecting and the victim phone returning to its home screen, but does not identify the Telegram or Android versions shown.

NebuSec chief executive Eten Zou told The Hacker News that Telegram acknowledged the company’s report but did not believe the issue could be used for remote code execution. Zou said there was no bug bounty payment and no CVE number. Telegram had not issued a public statement in the source material, and the startup had not published a detailed technical write-up as of October 29.

A review of Telegram’s public Android source code described in the source material found a change between versions 12.10.3 and 12.10.4 in how call-status messages handle a video-rotation field. The earlier code checked that one value was present but then read a different field that might be absent; the newer code reads the rotation value. That code comparison supports the existence of a correction, but does not by itself verify NebuSec’s claimed three-part exploit or its reported impact.

Why Answering a Call Matters

The report draws attention to a part of a messaging app that must process incoming data while a call is being set up. Unlike a message that a user can choose to open later, a call involves real-time exchanges as the app connects. A flaw in that code could make an ordinary action—answering a call—part of an attack, if NebuSec’s account of the full chain is accurate.

For users, the immediate practical step is straightforward: update Telegram for Android and check that the installed version is 12.10.4 or later. Until updated, the source recommends restricting who can call the account to contacts or nobody, and declining calls from unknown people. Those steps reduce exposure to the described route; they do not establish that every unknown call is malicious or that all versions and platforms face the same risk.

The report also has implications for organizations that track app security through vulnerability databases. With no CVE assigned, systems that rely only on CVE feeds may not flag the issue. The source recommends setting minimum app versions on work phones and establishing a policy for messaging apps. The case also shows why a released software correction can matter even when public details about its security significance arrive later.

Products Worth Considering

Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB

AmazonView Latest Price

Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo

AmazonView Latest Price

HP Sprocket Photo Booth Machine Instant Color Photo Printer with 10.1 Touchscreen, LED Ring Light, 250+ Frames, 3×4 ZINK Paper, QR Code Shar

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predated the Disclosure

NebuSec said it reported the flaw to Telegram on September 26, shortly after version 12.10.4 appeared. The source’s comparison of Telegram’s public code says the Android correction was present in version 12.10.4, published September 24. It also identifies a similar change in Telegram’s shared call library, tgcalls, dated April 21, 2026, under the change title “Fix camera rotation.” That history suggests the code adjustment existed before NebuSec’s public disclosure, but the reason Telegram made it has not been established in a public statement.

The source says the National Vulnerability Database had no CVE entry for the flaw as of October 29, and the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry. Those absences mean the issue was not listed in those records at the time; they do not prove that exploitation never occurred.

NebuSec’s account, as relayed by The Hacker News, says the startup saw no real-world attacks. The source also reports no evidence that Telegram’s iOS or desktop apps, or group calls, were directly affected. It says the shared library correction appeared in iOS in May and desktop in July, but that the exploitability of earlier versions on those platforms has not been shown.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

Exploit Details Still Unverified

The most consequential claim—that the call bug, an information-leak bug and an Android root exploit could be combined to take over a device—rests on NebuSec’s description and demonstration. The public video does not reveal the software versions or show the underlying code, and the startup had not released a detailed technical write-up by October 29. The source’s code comparison supports the presence of a relevant change, but cannot establish the full attack chain on its own.

It is also not clear whether the reported chain works against a fully updated Android phone, whether anyone exploited the flaw before disclosure, or which Android versions and device models are affected. NebuSec says it has seen no real attacks, but absence of observed attacks is not proof that none occurred. The source reports no direct evidence of impact on iOS, desktop or group calls; it does not establish that every earlier build on those platforms is safe.

Telegram’s public position remains another open point. According to Zou, the company acknowledged the report and disputed the possibility of remote code execution. The source says no public Telegram comment was available as of October 29, leaving its assessment of the bug, its earlier code change and the claimed exploit chain unconfirmed by the company in public.

Update and Watch for Documentation

Android users should install the latest Telegram version available for their device and verify that it is 12.10.4 or later, the version identified in the report as containing the correction. If an update is not yet available through a device’s app store, users can limit incoming calls to contacts or disable them temporarily and avoid answering calls from unfamiliar accounts.

Organizations should check whether managed phones meet their minimum app-version requirements rather than relying only on vulnerability-feed alerts. Security teams can also watch for a Telegram statement, a NebuSec technical report, or a CVE entry that may clarify the affected code, prerequisites and platform scope. Until more evidence is published, the exact reach of the claimed attack chain and any past exploitation remain unresolved.

Key Questions

What is the Telegram Android flaw?

NebuSec describes a flaw in Telegram’s Android call-handling code involving a missing or incorrectly read field in a call-status message. The startup says it could be combined with two other bugs to compromise a phone, but the full chain has not been documented publicly.

Which Telegram version fixes the reported issue?

The source identifies Telegram for Android 12.10.4 as the version containing the correction. Users should check for that version or a later release.

Could an attacker hack a phone without the user doing anything?

Not according to NebuSec’s description. The company says the user had to answer an incoming voice call, making the claimed attack one-click rather than zero-click.

Has the flaw been used in real attacks?

NebuSec says it has seen no real-world attacks. That is the company’s report, not proof that exploitation never occurred; the source says public evidence remains unavailable.

Are Telegram on iPhone and desktop affected?

The source reports no evidence that iOS or desktop apps, or group calls, were directly affected. Similar code was updated on other platforms, but the impact of earlier versions there has not been established.

Source: ThorstenMeyerAI.com