Telegram’s Android Flaw: What’s Known And What Users Can Do

🔍 Read the full analysis: Telegram’s Android Flaw: What’s Known And What Users Can Do on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on office and shipping supplies

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of three bugs to take control of a phone after its owner answered a call. Telegram had already released version 12.10.4, which contains a correction to the call-handling code; NebuSec says it has seen no real-world attacks, while the full attack chain has not been independently documented in a public technical report.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range dating from March 2022 to September 2026. The company said the call-related bug by itself was not enough to take over a phone. In comments to The Hacker News, NebuSec chief executive Eten Zou said an attacker would also need to use a second bug to escape the Telegram app and a third Android exploit to gain root, or administrator-level, access.

NebuSec said the attacker needed an ordinary Telegram account and that its testing worked on private voice calls on ARM64 devices. Its short demonstration video shows a call connecting before the victim phone returns to its home screen. The video does not identify the Telegram or Android versions used, and it does not independently establish every step of the claimed attack chain.

A review of Telegram’s public Android source code described in the source material found a change between versions 12.10.3 and 12.10.4 in how the app reads a video-rotation value in call messages. The earlier code checked that one field was present, then read a different field that might be absent; the newer code reads the checked field. This supports the presence of a call-code correction, but does not verify the two additional bugs or the claimed full-device compromise.

Why Call Access Raises Risk

Voice calls require an app to process incoming information before a user has decided whether to trust the caller. That makes call-handling code a potential route into a device if it contains a vulnerability. In this case, however, answering a call is not described as sufficient on its own: NebuSec says the flaw had to be combined with two other bugs. The reported scenario is therefore a one-click attack, because the victim must answer, rather than a zero-click attack.

The practical priority for users is straightforward: install the fixed app version and limit who can call while an update is unavailable. For organizations, the report also highlights a patch-management gap. The source material says the flaw has no CVE identifier, so security systems that rely only on CVE tracking may not flag it. Companies can reduce that blind spot by setting minimum app versions for work phones and defining which messaging apps are allowed for work.

Popular right now

KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream

AmazonView Latest Price

eufy E25 Robot Vacuum and Mop Combo with HydroJet Roller Mop

AmazonView Latest Price

Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

How the Android Fix Surfaced

NebuSec said it reported the issue to Telegram on September 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution; according to Zou, no CVE was assigned and no bounty was paid. The source material says it found no public Telegram statement responding to the disclosure.

The code history adds a caveat: Telegram’s shared call library received the same correction on April 21, 2026, in a change titled “Fix camera rotation,” before the Android source with the fix appeared. The report says the iOS app incorporated the change in May and the desktop app in July. That timing does not establish that those apps were exploitable, and NebuSec has not shown that iOS, desktop or group calls were directly affected.

As of October 29, the source material reports no CVE in the U.S. National Vulnerability Database and no Telegram entry in the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog. Those absences indicate that the flaw was not listed there at that time; they do not prove it was never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Cannot Show

The main unresolved issue is whether the complete attack chain works as NebuSec described. The company has not published a technical write-up of this flaw, and the demonstration does not show the software versions on the phones. The source material says the call-code correction could be checked in Telegram’s public source, but the second information-leak bug and Android root exploit could not be checked independently.

It is also unclear whether the claimed chain works against a fully updated Android device, whether anyone exploited the flaw before disclosure, and whether any Telegram versions outside the stated Android range are affected. NebuSec said it had seen no real attacks; that is the company’s assessment, not proof that none occurred. The absence of a CVE and an entry in the U.S. exploited-vulnerabilities catalog does not settle those questions.

Update and Restrict Incoming Calls

Android users should update Telegram and check the version number at the bottom of the app’s Settings screen. The reported fix is in version 12.10.4 or later. Until the update is installed, users can open Telegram’s privacy settings, set “Who can call me?” to “My Contacts” or “Nobody,” and decline calls from unfamiliar accounts. These steps reduce exposure to the described call route but do not establish that every risk is eliminated.

Further clarity depends on whether NebuSec publishes technical details, Telegram comments publicly, or independent researchers reproduce the claimed chain. Organizations should check app versions on managed devices rather than relying only on CVE alerts. The source material does not give a date for any further disclosure or investigation.

Key Questions

Which Telegram Android versions are reported to be affected?

NebuSec identified versions 8.6.2 through 12.10.3. The reported correction is in version 12.10.4; users should check the version shown in Telegram’s Settings.

Does answering a call alone give an attacker control of a phone?

Not according to NebuSec’s account. The company said the call bug had to be combined with two additional bugs, including an Android root exploit, to gain full control. That chain has not been independently established in a public technical report.

Have attacks using the flaw been confirmed?

NebuSec said it had seen no real attacks. The source material reports no public evidence confirming exploitation, but the absence of observed attacks does not prove that none occurred.

What should users do if they cannot update immediately?

Set Telegram’s “Who can call me?” privacy control to My Contacts or Nobody and decline calls from unfamiliar accounts until the update is installed.

Are Telegram on iPhone and desktop affected?

NebuSec has not shown that the iOS or desktop apps are directly affected. The source material says the shared call library received a similar correction and that those apps incorporated it, but exposure on those platforms has not been established.

Source: ThorstenMeyerAI.com