TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec says a flaw in Telegram for Android call code, combined with two other bugs, could let an attacker take control of a phone after the user answered a call. Telegram’s version 12.10.4 contains a code change that addresses the call bug, but the full attack chain has not been independently documented and NebuSec says it has seen no attacks.
Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying it could help attackers take control of a phone if a user answered a call and two other bugs were chained with it. Telegram’s version 12.10.4 includes a correction to the affected call code, according to NebuSec and a comparison of the public app source described in the source material. NebuSec says it has seen no real-world attacks; details of the complete attack chain have not been publicly documented.
NebuSec said the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company described a memory-handling error in code used during voice calls. According to NebuSec chief executive Eten Zou, the call flaw alone was not sufficient: an attacker also needed a second bug to escape the app and a third Android exploit to gain root access, or full administrator control of the phone.
NebuSec said its demonstration involved private voice calls on ARM64 phones and that an ordinary Telegram account was enough to make the call. Its 22-second video shows a call connecting on a phone labelled as the victim, followed by the Telegram app closing and a graphic claiming the phone had been hacked. The video does not identify the Telegram or Android versions used, and the company had not published a detailed technical write-up as of October 29.
The source material describes a comparison of Telegram’s public Android code in versions 12.10.3 and 12.10.4. In the earlier version, the code checked that a camera-rotation value was present but then read a separate video-state field that might be absent. The later version reads the rotation field. NebuSec reported the flaw to Telegram on September 26, after version 12.10.4 had appeared. Zou said Telegram acknowledged the report but disputed that the bug could be used for remote code execution. No CVE was assigned, and Zou said no bounty was paid.
Telegram’s Android Flaw Explained: Risks And Next Steps
NebuSec says a flaw in Telegram’s Android call code could contribute to a phone takeover when combined with two other bugs. The reported chain requires the user to answer a call; its full technical details remain unverified in public.
Answering the call is the trigger
According to NebuSec, the call-code flaw would need to be chained with an app escape and a separate Android exploit to reach full device control.
Answer a call
The user action starts the reported scenario. NebuSec calls it one-click, not zero-click.
Trigger call flaw
A memory-handling error in code used during voice calls is the first reported bug.
Escape the app
A second bug is reportedly needed to move beyond Telegram’s app boundary.
Gain root access
A third Android exploit is reportedly needed for full administrator control.
Evidence limit: NebuSec has not publicly documented the complete chain or the other two bugs.
A small code correction, a large claim
The source comparison described in the report focuses on which video field the Android code reads during call handling.
Earlier code · 12.10.3
Checks camera-rotation fieldReads separate video-state field
That field may be absent
NebuSec described the mismatch as a memory-handling flaw in call code.
Updated code · 12.10.4
Checks camera-rotation fieldReads that same rotation field
Correction appears in public source
NebuSec identifies Android version 12.10.4 (7099) as containing the fix.
Shared library change
The tgcalls library received a camera-rotation correction titled “Fix camera rotation.”
Android source appears
The Android source with the fix appeared 156 days after the shared-library change.
Report to Telegram
NebuSec says it reported the flaw after version 12.10.4 had appeared.
Public disclosure
NebuSec disclosed the issue and said it had seen no real-world attacks.
What is known—and what is not
The public record described here supports a code change and a reported demonstration, but does not establish the full attack chain.
Call-code correction
Public Android source shows a change between versions 12.10.3 and 12.10.4 to read the camera-rotation field.
Complete compromise chain
NebuSec’s 22-second video does not identify app or Android versions. A detailed technical write-up was not public as of October 29.
Other devices and platforms
The source says related changes appeared in iOS and desktop code, but does not establish exploitability on those platforms or across Android configurations.
Company statement
NebuSec says it saw no attacks. The demo reportedly used private voice calls on ARM64 phones and an ordinary Telegram account.
Public tracking
No CVE or cited CISA known-exploited listing was reported. Those absences do not prove that exploitation did not occur.
Update, then reduce exposure
The source material identifies Telegram for Android 12.10.4 or later as patched. Organizations should track app versions even when a CVE is not available.
Check and update
Open Telegram Settings and check the version shown at the bottom. Update to 12.10.4 or later.
Restrict incoming calls
Set “Who can call me?” to My Contacts or Nobody, and decline calls from people you do not recognize.
Enforce minimum versions
Check managed-phone app versions and include messaging apps in mobile security policy, including flaws without CVE records.
Quick answers
The claims below reflect the disclosure and source material as of October 29, 2026.
Could it happen without answering?
NebuSec’s described method requires the victim to answer a call, making it one-click rather than zero-click. The full chain is not publicly documented.
Is there evidence of attacks?
NebuSec says it has seen no real-world attacks. The lack of a CVE or catalog listing does not settle whether others observed activity.
Are iPhone and desktop users affected?
Related fixes reportedly appeared in iOS and desktop code. Available information does not establish whether those versions were exploitable.
What should users install?
Telegram for Android 12.10.4 or later is identified as containing the call-code correction. Check the version in Settings and update.
Why Answered Calls Matter
If NebuSec’s account of the full chain is accurate, answering an ordinary call could serve as the user action that starts a serious compromise. That makes the report relevant to people who assume a phone is at risk only when they open a file or install an app. The alleged attack is one-click, because the user must answer; it is not described as zero-click.
The disclosure also highlights a practical gap for organizations: a software fix can be difficult to track when a flaw has no CVE identifier. Companies whose mobile security processes rely only on CVE feeds may not flag the update. The source material recommends enforcing minimum app versions on work phones and setting a policy for messaging apps.
Products Worth Considering
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video
As an affiliate, we earn on qualifying purchases.
A Call-Code Change Before Disclosure
The source material says Telegram’s shared call library, tgcalls, received the same camera-rotation correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the fix appeared on September 24, 156 days later, according to the author’s calculation. The Hacker News reported that the iOS app received the change in May and the desktop app in July. The available information does not establish whether the earlier code could be exploited on those platforms.
As of October 29, the source material reports no CVE in the U.S. National Vulnerability Database and no Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog dated October 28. It also says the author found no public Telegram statement. These absences do not independently prove that exploitation did not occur; NebuSec itself said it had seen no attacks.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
Limits of the Public Evidence
The full chain remains unverified in public technical detail. The source material says NebuSec had not published a write-up of the call flaw or the other two bugs, and the demo does not show the software versions involved. The author says they could not check the other bugs or determine whether the chain worked across other devices and configurations.
It is also unclear whether any attacks occurred outside NebuSec’s observations, whether Telegram will publish its own account, or whether the earlier shared-library code exposed iOS or desktop users. The absence of a CVE and of a listing in the cited government catalog does not resolve those questions.
Update and Restrict Calls
Android users should update Telegram and check the version shown at the bottom of Settings. The source material identifies version 12.10.4 or later as the patched release. Until updated, it recommends changing “Who can call me?” to My Contacts or Nobody and declining calls from people the user does not recognize.
Organizations should check app versions on managed phones and account for flaws that lack CVE records. Further clarity depends on any technical disclosure from NebuSec or public response from Telegram, as well as evidence about the other bugs and whether the reported chain works beyond the devices NebuSec says it tested.
Key Questions
What is the Telegram Android flaw?
NebuSec describes a memory-handling error in Telegram’s Android call code. It says the flaw could be combined with two other bugs to gain control of a phone after the user answered a call.
Which Telegram version fixes the reported call bug?
The source material identifies Telegram for Android 12.10.4 as containing the correction. Users should check the version in Settings and update if they are running an earlier release.
Could the attack happen without answering a call?
NebuSec’s account requires the victim to answer, so the reported method is one-click rather than zero-click. The public material does not provide a complete technical write-up of the chain.
Is there evidence that attackers used the flaw?
NebuSec said it had seen no real-world attacks. The source material also reports no CVE and no entry in the cited CISA catalog, but those facts do not establish whether attacks occurred outside the company’s observations.
Are Telegram on iPhone and desktop affected?
The source material says the correction appeared in Telegram’s shared call library and later in iOS and desktop code, but it does not establish that those apps were exploitable. Direct impact on those platforms remains unclear.
Source: Thorsten Meyer AI
