How To Think About The Telegram Android Call Vulnerability

🔍 Read the full analysis: How To Think About The Telegram Android Call Vulnerability on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed on October 29 a vulnerability in Telegram’s Android call code, saying it could help an attacker take control of a phone after a user answered a call if it was combined with two other bugs. Telegram Android version 12.10.4 includes a relevant code fix, but the full attack chain has not been publicly documented, and NebuSec said it had seen no real-world attacks.

NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company’s chief executive, Eten Zou, told The Hacker News that the call bug was not sufficient by itself: it allegedly needed to be combined with a second bug that leaked information and a third exploit that gained Android root access. Root access can give an attacker broad control over a device, including access to data and hardware such as the microphone and camera. These are NebuSec’s claims; the supplied account says the other two bugs have not been independently examined.

NebuSec said it tested the chain in private voice calls on ARM64 Android phones, a chip architecture used by most modern Android devices. Its 22-second demonstration video shows a call connecting before the victim phone returns to its home screen and displays a “HACKED BY NEBUSEC” graphic. The video does not identify the Telegram or Android versions on the victim device, and the account says NebuSec had not published a technical write-up as of October 29. A successful demo, as described, is not by itself a public explanation of every step or a measure of how widely the exploit could work.

A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 found a change in the call code. The older code checked that a camera-rotation value was present, then read a different field for video state; the newer code reads the rotation field. That check supports the existence of a relevant coding error and its correction, but does not verify NebuSec’s claimed three-bug chain. The source account also says the shared call library received a similar correction in April 2026, before the Android update and NebuSec’s September report.

Why Answering a Call Matters

The reported trigger makes this a one-click risk, not a zero-click attack: the target would need to answer an incoming call, according to NebuSec’s account. That distinction matters for practical advice. Users can reduce exposure by declining calls from unknown callers and limiting who is allowed to call them, while installing the corrected app version.

The issue also illustrates why call features can be security-sensitive. A messaging app has to process information from the caller to establish a connection and manage audio or video. If that processing contains a flaw, the data may reach vulnerable code before a user knows who is calling. NebuSec’s description, if accurate, suggests that the call bug could form one link in a longer attack chain rather than provide full device access on its own.

For organizations, a patched app may not be easy to identify through tools that track only formally assigned vulnerability identifiers. The supplied account says the flaw had no CVE number as of October 29. Employers using Telegram on work phones may need to set a minimum app version and clear rules for approved messaging apps, rather than relying only on CVE-based alerts.

Products Worth Considering

Oral-B iO Series 7 Rechargeable Electric Toothbrush with 2 Brush Heads and Charging Travel Case

AmazonView Latest Price

Therabody JetBoots Prime Wireless Compression Boots (Short, Under 29-Inch Inseam)

AmazonView Latest Price

LEVOIT Vital 200S-P Smart Air Purifier for Large Rooms

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec said it reported the issue to Telegram on September 26, 2026, shortly after Android version 12.10.4 became available. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of remote code execution, and that NebuSec received no bounty. These details are attributed to Zou; the source account reports no public statement from Telegram responding to the disclosure.

The code timeline adds detail but does not settle the security questions. The shared call library used across Telegram clients received a camera-rotation correction on April 21, according to the account’s review of public code. The Android source containing the correction appeared later, in version 12.10.4. The Hacker News was cited as reporting that iOS picked up the change in May and desktop in July. Those code changes do not establish that the other platforms were exploitable, and NebuSec reported no direct evidence that iOS, desktop or group calls were affected.

As of October 29, the account found no CVE entry for the issue in the U.S. National Vulnerability Database and no Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, using the catalog dated October 28. The lack of a listing is not proof that the bug was harmless or unused; it means those public records did not list it at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central uncertainty is whether NebuSec’s described chain can be independently reproduced. The supplied account says the company had released a short demonstration but no technical write-up, and the video does not identify the software versions used. The comparison of Telegram’s source code supports the presence of a relevant bug and a later correction, but it does not confirm the information-leak bug, the root exploit or the claimed full-control outcome.

It also remains unknown whether anyone exploited the issue before it was fixed. NebuSec said it had seen no real attacks; that is not evidence that no attacks occurred. The source material reports no public Telegram response and no CVE assignment. It does not establish whether the flaw was exploitable on fully patched Android devices, or whether related code changes reflect risk on iOS or desktop.

Update and Restrict Calls

Android users should install the latest Telegram version available to them and check the version shown in the app’s settings. The cited fixed release is 12.10.4 or later. If an update is not yet available through a user’s app store or device, NebuSec’s recommended interim steps in the source account are to set “Who can call me?” to My Contacts or Nobody and decline calls from strangers.

Organizations should check whether work devices meet their app-version requirements and decide whether Telegram is permitted for work communications. Security teams may need to monitor vendor advisories and app releases directly because a flaw without a CVE can be missed by processes that depend on vulnerability databases alone.

The next useful evidence would be a technical account that allows independent researchers to evaluate the complete exploit chain, along with a clear statement from Telegram about the affected versions and the scope of the fix. Until then, the code change and NebuSec’s report should be treated as distinct pieces of evidence: the former supports that relevant code was corrected, while the latter supplies the still-unverified claims about full device compromise.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said versions 8.6.2 through 12.10.3 were affected and identified Android version 12.10.4 as containing the fix. The account recommends using 12.10.4 or a later release.

Could the call flaw alone give an attacker control of a phone?

According to NebuSec chief executive Eten Zou, no. He said the call bug had to be combined with two other bugs, including an Android root exploit, for the claimed full-control outcome. The source material says that complete chain has not been publicly documented.

Does the report say the flaw was used in real attacks?

No. NebuSec said it had seen no real-world attacks. That report does not establish that the flaw was never used; whether exploitation occurred remains unknown.

Are Telegram on iPhone and desktop affected?

The source account says NebuSec had no evidence that the iOS or desktop apps, or group calls, were directly affected. Related call-library code was changed in other clients, but the account does not establish that those versions were exploitable.

What should users do if they cannot update right away?

Set Telegram’s “Who can call me?” option to My Contacts or Nobody, and decline calls from people you do not recognize until you can update. These steps reduce exposure but do not replace installing the corrected version.

Source: ThorstenMeyerAI.com