What’s The Connection Between Telegram Calls And The Android Flaw?

🔍 Read the full analysis: What’s The Connection Between Telegram Calls And The Android Flaw? on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying attackers could combine it with two other bugs to take control of a phone after its owner answered a call. Telegram had already corrected the call-code issue in version 12.10.4, released in September, but the full attack chain has not been publicly documented and NebuSec says it has seen no real-world attacks.

NebuSec says the affected range is Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company says the call bug was only one part of a chain: a second flaw allegedly exposed information that helped an attacker escape Telegram’s app environment, and a third Android exploit allegedly provided root-level access, or administrator control. The attacker would need a Telegram account, and the recipient would have to answer the call. That makes the reported method one-click, not zero-click.

NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 phones, a processor architecture used in most modern Android devices. NebuSec posted a short demonstration on X, but the video does not identify the Telegram or Android versions on the phone shown. As of October 29, the company’s research page did not contain a technical write-up explaining the full chain.

A review of Telegram’s public Android source code found a change between versions 12.10.3 and 12.10.4 in the handling of call status messages. Those messages can carry information such as microphone mute status, camera state and video rotation. In the earlier code, the app checked that a rotation value existed but then read a different field that might be absent. The newer code reads the rotation field. This code change is consistent with a memory-handling bug in call processing, but it does not independently verify NebuSec’s claims about the other two bugs or a complete takeover.

Why Answered Calls Matter

The report matters because answering an incoming call is an ordinary action, yet call features must process data from the caller to establish a connection. If NebuSec’s account of the chain is accurate, a recipient’s answer could have allowed malicious call data to trigger a flaw and then help an attacker move beyond Telegram. The company says the final step could expose messages, microphone and camera, but those consequences have not been independently demonstrated in a public technical report.

For individual users, the immediate practical step is to update Telegram and check that the installed version is 12.10.4 or later. Until updated, NebuSec’s advice is to restrict who can call through Telegram’s privacy settings to contacts or nobody, and to decline unexpected calls. These steps reduce exposure to calls from strangers; they do not establish whether a particular device was targeted or protect against unrelated Android vulnerabilities.

The absence of a CVE number also creates a problem for some organisations. Security tools that rely on CVE databases may not flag an app flaw that has no assigned identifier. Employers using Telegram on work phones may need to verify app versions directly and set minimum-version rules, rather than relying only on vulnerability feeds.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Anker SOLIX S2000 Portable Power Station, 2,010Wh, 1,500W

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

From Code Change to Disclosure

NebuSec announced the issue on X on October 29, 2026. Zou told The Hacker News that the company reported the flaw to Telegram on September 26, shortly after version 12.10.4 had appeared. According to Zou, Telegram acknowledged the report but did not agree that the issue could be used for remote code execution. Zou also said no bug bounty was paid. These details come from the company’s account; Telegram had not issued a public statement identified in the supplied reporting.

The timeline of the code offers a separate, narrower piece of evidence. Telegram’s shared call library, tgcalls, received a correction titled “Fix camera rotation” on April 21, 2026. The Android source code containing the fix appeared later, in version 12.10.4. The source review described in the report found the corresponding change in the Android app. The Hacker News reported that iOS incorporated the change in May and desktop in July, but the supplied material does not establish whether those older versions were exploitable.

As of October 29, the flaw had no CVE entry in the US National Vulnerability Database and no Telegram listing in the US Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, whose version was dated October 28. Those absences do not prove that the flaw was never exploited; they indicate only that it was not listed in those sources at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post on X

What the Public Evidence Cannot Show

The central unresolved issue is whether the reported chain works as NebuSec describes. The company has not published a technical account of the two additional bugs, the steps linking them, or enough details for outside researchers to assess the complete claim. Its demonstration shows a phone apparently being affected after a call connects, but does not reveal the software versions or establish which vulnerability caused the displayed result.

NebuSec says it has seen no real-world attacks. That is not proof that no one used the flaw, and there is no public CVE or government exploited-vulnerability listing as of the dates checked. The supplied reporting also says the call code was tested on ARM64 phones, but it does not establish how the chain behaves across Android versions, device manufacturers or security patch levels, including fully updated phones.

The confirmed scope is also limited. NebuSec identified Android versions 8.6.2 through 12.10.3, but the supplied material does not demonstrate that Telegram’s iOS or desktop apps, group calls, or other call modes were exploitable. A shared-library correction and reports that other apps later received it do not, on their own, prove that those versions could be attacked.

Update and Watch for Details

Android users should update Telegram through their usual app store or Telegram’s official distribution channel, then check the version shown in Settings. The version named as fixed is 12.10.4; users should install a later release if one is available. Those who cannot update immediately can limit incoming calls to contacts or disable them, as NebuSec recommends, and avoid answering unexpected calls from unknown accounts.

For a clearer assessment, researchers and users need a technical write-up that describes the complete chain, the affected Android configurations and the role of each bug. A public response from Telegram could clarify how the company assessed the report and whether it considers any other platform or call type affected. Until those details emerge, the call-code correction is supported by the public source-code comparison, while the broader claim of a full device takeover remains attributable to NebuSec.

Organisations should check deployed Telegram versions rather than treating the lack of a CVE as evidence that no action is needed. They can set a minimum app version for managed phones and review whether their messaging policies permit Telegram on devices that handle sensitive work. No public evidence currently establishes exploitation, but the available information is not enough to rule it out.

Key Questions

What is the Telegram Android flaw?

NebuSec describes a memory-handling error in Telegram’s Android call code. A source-code comparison shows that version 12.10.4 changed how the app reads a video-rotation field in call status messages. The code change supports the existence of a call-handling bug, but does not by itself verify the full exploit chain NebuSec describes.

Did answering a Telegram call automatically hack a phone?

Not on the evidence available. NebuSec says an attacker could exploit the issue after the recipient answered, but also says the call flaw had to be combined with two additional bugs. The complete chain has not been documented publicly, and the company says it has seen no real-world attacks.

Which Telegram versions are reported as affected?

NebuSec identified Android versions 8.6.2 through 12.10.3 as affected and named version 12.10.4 as fixed. The supplied evidence does not confirm that iOS, desktop or group-call features were exploitable.

What should Telegram users do now?

Update Telegram for Android to version 12.10.4 or later and confirm the installed version in Settings. If an update is not yet possible, NebuSec recommends limiting who can call to contacts or nobody and declining unexpected calls.

Has the flaw been exploited in real attacks?

NebuSec says it has seen no real-world attacks. The flaw had no CVE entry or listing in the US known-exploited-vulnerabilities catalog as of October 29, 2026, but those facts do not establish that exploitation never occurred.

Source: ThorstenMeyerAI.com